CVE-2026-65583
Critical · 9.1CVSS
9.1
EPSS
0.3%
Published
Aug 6, 2026
CISA due date
—
The record
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2022-30267 Emerson Ovation was found to have no authentication of firmware signing and relies on an… CWE-345
- CVE-2026-76894 CKAN MCP Server is a tool for querying CKAN open data portals. CWE-345
- CVE-2026-121545 Dreeve before 5.8.0 contains a missing authentication vulnerability in… CWE-345
- CVE-2026-119731 Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its… CWE-345
- CVE-2026-103310 The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the… CWE-345
- CVE-2026-120317 http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability… CWE-345
- CVE-2026-63115 ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. CWE-345
- CVE-2026-119289 Zuke is a code-first, strongly typed build automation system for Deno. CWE-345