Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-68481

Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and 'introspection of a revoked token MUST return {"active":false}'. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache CXF

Default version status: unaffected

  • 4.2.0 to < 4.2.3affected
  • 4.0.0 to < 4.1.8affected
  • 0 to < 3.6.12affected

References