Dashboard / CVE-2026-50627

CVE-2026-50627

CRITICAL
INFO Priority: 0.41 BB Relevance: 64/100
Published: 2026-06-12 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: Changed
C: High
I: High
A: High

Description

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Weakness Classification (2)

Affected Software (2)

VendorProductVersion
apache cxf < 4.1.7
apache cxf 4.2.0 – 4.2.2

References & Advisories (6)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

9.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS — Exploitation Probability

4.52%
Raw Score 0.045240
Percentile 91.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.04524
2026-10-28
0.04524

Intelligence Sources

nvd ref →

External Links