CVE-2026-50627: Apache CXF: Missing JWT Audience Validation in OAuth2 Access Token Validator
CVE-2026-50627 affects the JwtAccessTokenValidator class in Apache CXF, which the record says does not validate the 'aud' (Audience) claim of incoming JWT access tokens. This can allow a token issued for one Resource Server to be accepted by a different Resource Server, enabling token confusion or routing attacks. The record rates it critical (CVSS 9.1 from NVD) and recommends upgrading to 4.2.2, 4.1.7 or 3.6.12; no confirmed exploitation appears in the sources consulted.
Overview
Apache CXF published CVE-2026-50627 on 2026-06-12 for the JwtAccessTokenValidator class, which the record says does not validate the 'aud' (Audience) claim of incoming JWT access tokens. The record is rated critical, with a CVSS 9.1 score from NVD. Background is available in the Apache mailing list thread and the NVD entry.
Impact
According to the description, a JWT issued for one Resource Server can be accepted by a different Resource Server. The description links this to token confusion and token routing attacks.
- Confirmed: the audience check is described as missing from the validator.
- Inference: deployments where one identity provider issues tokens for several resource servers are the most exposed to this kind of confusion.
- Unknown: the record does not describe which data or operations could be reached in a concrete deployment.
Affected products and versions
The record lists Apache Software Foundation Cxf with these ranges: before 3.6.12; from 4.0.0 before 4.1.7; before 4.1.7; and from 4.2.0 before 4.2.2.
- Confirmed: the description recommends upgrading to 4.2.2, 4.1.7 or 3.6.12.
- Inference: each listed branch appears to have its fix at the version that closes its range.
- Unknown: the record does not name a fixed version for the 4.0.x line; the listed range for it ends at 4.1.7.
Exploitation status
The CISA KEV flag is false for this record, so no active exploitation is confirmed here. No confirmed exploitation appears in the sources consulted. The SSVC record lists exploitation as none and automatable as no. The EPSS probability is 0.00776 with a percentile of 0.55334.
Remediation and mitigation
- Upgrade Apache CXF to the fixed release in your branch, as listed in the affected ranges above.
- If you use distribution packages, check the vendor advisory, such as the Red Hat errata RHSA-2026:37390, for the packaged fix.
- Where an upgrade is not immediately possible, review how your resource servers validate audience values in JWT access tokens and restrict token acceptance to tokens issued for that server.
Detection guidance
- Review authentication logs of each resource server for access tokens whose audience does not match that server's identifier.
- Check whether custom JWT validation code in your environment bypasses the standard audience check.
Limitations of the available information
The title mentions issuer validation, but the description only mentions the audience claim. Whether issuer validation is also affected is unknown from the record. The record has no fixes entries, a null CWE name for CWE-289, and no technical details beyond the description.
Frequently asked questions
What is the core problem in CVE-2026-50627?
According to the record, the JwtAccessTokenValidator class in Apache CXF does not validate the 'aud' (Audience) claim of incoming JWT access tokens, so a token issued for one resource server may be accepted by another.
Which versions does the record recommend?
The description recommends upgrading to 4.2.2, 4.1.7 or 3.6.12, depending on your branch.
Is this vulnerability known to be exploited in the wild?
No. The KEV flag is false for this record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.