Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-57817

Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the `c_hash`, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache CXF

Default version status: unaffected

  • 4.2.0 to < 4.2.3affected
  • 4.0.0 to < 4.1.8affected
  • 0 to < 3.6.12affected

References