CVE-2026-50623
published 2026-06-12CVE-2026-50623: An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context…
PriorityP431medium4.8CVSS 3.1
AVNACHPRNUINSUCLILAN
EPSS
0.36%
28.6th percentile
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | cxf | < 4.1.7 | 4.1.7 |
| apache | cxf | >= 4.2.0 < 4.2.2 | 4.2.2 |
| apache_software_foundation | apache_cxf | < 3.6.12 | 3.6.12 |
| apache_software_foundation | apache_cxf | >= 4.0.0 < 4.1.7 | 4.1.7 |
| apache_software_foundation | apache_cxf | >= 4.2.0 < 4.2.2 | 4.2.2 |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
vendor_redhat4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache CXF has Authentication Bypass in OAuth2 TokenIntrospectionService
ghsa·2026-06-12
CVE-2026-50623 [MEDIUM] CWE-287 Apache CXF has Authentication Bypass in OAuth2 TokenIntrospectionService
Apache CXF has Authentication Bypass in OAuth2 TokenIntrospectionService
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7, which fixes this issue.
GHSA
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF.
ghsa_unreviewed·2026-06-12
CVE-2026-50623 [MEDIUM] CWE-287 An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF.
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7, which fixes this issue.
VulDB
Apache CXF up to 4.1.6/4.2.1 OAuth2 TokentrospectionService improper authentication
vuldb·2026-06-11
CVE-2026-50623 [CRITICAL] Apache CXF up to 4.1.6/4.2.1 OAuth2 TokentrospectionService improper authentication
A vulnerability labeled as critical has been found in Apache CXF up to 4.1.6/4.2.1. The affected element is the function TokentrospectionService of the component OAuth2. The manipulation results in improper authentication.
This vulnerability is cataloged as CVE-2026-50623. The attack may be launched remotely. There is no exploit available.
The affected component should be upgraded.
Red Hat
org.apache.cxf/cxf-rt-rs-security-oauth2: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
vendor_redhat·2026-06-12·CVSS 4.8
CVE-2026-50623 [MEDIUM] CWE-305 org.apache.cxf/cxf-rt-rs-security-oauth2: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
org.apache.cxf/cxf-rt-rs-security-oauth2: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
A flaw was found in Apache CXF. An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService. Due to a missing 'throw' keyword in the security context check, an unauthentic
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-12
Published