Loading story…
Apache disclosed CVE-2026-65583, a low-severity flaw in the Apache CXF OIDC relying-party token validation logic that can cause self-issued ID tokens to be accepted without required claim checks. Missing validation may skip verification of fields such as issuer, subject, audience, time-based claims, and sub_jwk binding, creating a path for authentication bypass with crafted tokens in deployments that accept self-issued ID tokens.
The issue affects the Apache CXF module org.apache.cxf:cxf-rt-rs-security-sso-oidc in versions 4.2.0 before 4.2.3, 4.0.0 before 4.1.8, and the 3.6.x line before 3.6.12. Apache said self-issued ID tokens are not accepted by default in the validator, but advised users to upgrade to 4.2.3, 4.1.8, or 3.6.12 to remediate the vulnerability. Guanping Zhang was credited with reporting the issue.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-06, Apache disclosed CVE-2026-65583 affecting org.apache.cxf:cxf-rt-rs-security-sso-oidc and said the issue was fixed in versions 4.2.3, 4.1.8, and 3.6.12. Apache also advised users to upgrade, noting that self-issued ID tokens are not accepted by default in the validator.
Apache credited Guanping Zhang with reporting CVE-2026-65583, a low-severity flaw in Apache CXF's OIDC relying-party token validation that could allow crafted self-issued ID tokens to bypass required claim checks. The content does not anchor a date for when the report was made.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceopenwall.com
Open sourcelists.apache.org
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache CXF disclosed **CVE-2026-57818**, a low-severity flaw in the OAuth2 component `org.apache.cxf:cxf-rt-rs-security-oauth2` that can let a single authorization code be redeemed multiple times. The issue stems from a time-of-check/time-of-use race condition in `JCacheCodeDataProvider`, allowing concurrent requests to obtain multiple distinct valid access tokens from one OAuth2 authorization code. The vulnerability affects Apache CXF **4.2.0 before 4.2.3**, **4.0.0 before 4.1.8**, and **3.6.x before 3.6.12**. Apache advised users to upgrade to **4.2.3**, **4.1.8**, or **3.6.12** to remediate the issue, and credited **Guanping Zhang** with reporting the bug.
Aug 6, 2026
Apache disclosed **CVE-2026-43512**, a moderate-severity authentication bypass in Tomcat's DIGEST authenticator that can let any user unknown to the configured Realm authenticate if the supplied password is `"null"`. The flaw affects multiple supported branches, including Tomcat `11.0.0-M1` through `11.0.21`, `10.1.0-M1` through `10.1.54`, and `9.0.0.M1` through `9.0.117`, with older unsupported releases potentially affected. Apache advised users to upgrade to `11.0.22+`, `10.1.55+`, or `9.0.118+`. Apache also disclosed **CVE-2026-44417**, a moderate-severity flaw in the JMS transport component of Apache CXF caused by an incomplete fix for **CVE-2025-48913**. The remaining vulnerable code path can still lead to remote code execution when untrusted users are allowed to configure JMS. Affected releases include CXF JMS transport `4.2.0` before `4.2.1`, `4.0.0` before `4.1.6`, and all `3.6.x` versions before `3.6.11`; Apache said organizations should upgrade to `4.2.1`, `4.1.6`, or `3.6.11`.
Jul 2, 2026
The Apache Software Foundation released security updates for **Apache CXF** to fix three newly disclosed vulnerabilities affecting enterprise deployments of the services framework. The flaws include **`CVE-2026-44930`**, an LDAP injection issue in the XKMS LDAP certificate repository that can let attackers manipulate backend search filters and retrieve arbitrary digital certificates, potentially enabling impersonation, interception of encrypted communications, and lateral movement. Apache also addressed an **XXE** flaw in WS-Transfer caused by insecure XML parser configuration, which could expose sensitive files and support internal network mapping, as well as a possible **remote code execution** condition tied to an incomplete fix for an older JMS-related bug. Affected releases include **4.2.0**, **4.0.0 through 4.1.5**, and older branches before **3.6.11**. Apache published patched versions **4.2.1**, **4.1.6**, and **3.6.11**, and guidance urges organizations to upgrade immediately, review LDAP access controls, monitor certificate access activity, and reduce exposure of XKMS components where possible. The disclosures indicate that while the LDAP flaw does not itself provide code execution, the combined set of weaknesses could materially affect trust infrastructure and server security in vulnerable environments.
Jun 29, 2026