Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2026-71575

Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache CXF

Default version status: unaffected

  • 4.2.0 to < 4.2.4affected
  • 4.0.0 to < 4.1.9affected
  • 0 to < 3.6.13affected
pkg:maven/org.apache.cxf/cxf-rt-rs-security-sso-oidc

References