Loading vulnerability…
Authentication bypass in Apache CXF self-issued OIDC ID token validation
CVE-2026-65583 is an insufficient authenticity verification vulnerability in Apache CXF's OpenID Connect relying-party token validation. When configured to accept self-issued ID tokens, the validator can omit required issuer, subject, audience, time, and sub_jwk binding checks, allowing crafted tokens to bypass authentication. Affected releases include 4.2.0 through versions before 4.2.3, 4.0.0 through versions before 4.1.8, and releases before 3.6.12. Self-issued ID tokens are rejected by default, so exploitation requires a non-default configuration that accepts them.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can potentially bypass authentication in an application using the affected Apache CXF OIDC validator by presenting a crafted self-issued ID token. This can permit unauthorized access to application resources protected by the affected authentication flow. The resulting access depends on the application's authorization policies; administrative access, code execution, and availability impacts are not established.
If you can’t patch tonight, do this now.
Until upgraded, disable acceptance of self-issued ID tokens in the Apache CXF OIDC relying-party validator. Retain the default configuration that rejects these tokens and avoid authentication flows that depend on their acceptance.
Patch, then assume compromise.
Upgrade Apache CXF to the applicable fixed release: 4.2.3, 4.1.8, or 3.6.12.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.