Apache CXF OIDC Flaw Could Let Crafted Self-Issued Tokens Bypass Authentication

Apache disclosed CVE-2026-65583, a low-severity flaw in the Apache CXF OIDC relying-party token validation logic that can cause self-issued ID tokens to be accepted without required claim checks. Missing validation may skip verification of fields such as issuer, subject, audience, time-based claims, and sub_jwk binding, creating a path for authentication bypass with crafted tokens in deployments that accept self-issued ID tokens.

The issue affects the Apache CXF module org.apache.cxf:cxf-rt-rs-security-sso-oidc in versions 4.2.0 before 4.2.3, 4.0.0 before 4.1.8, and the 3.6.x line before 3.6.12. Apache said self-issued ID tokens are not accepted by default in the validator, but advised users to upgrade to 4.2.3, 4.1.8, or 3.6.12 to remediate the vulnerability. Guanping Zhang was credited with reporting the issue.