# org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven) vulnerabilities 11 known vulnerabilities (5 critical, 3 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.2.4 (Oct 1, 2026): no advisory affects it - Newest unaffected release: 4.2.4 (Oct 1, 2026), the latest release - Dependents: 40 - Releases: 168 since 2.6.0 (Apr 12, 2012) - Registry: https://central.sonatype.com/artifact/org.apache.cxf/cxf-rt-rs-security-oauth2 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-57818: 2.6.0 to 3.6.11 (3.6.12 is outside it); 4.0.0 to 4.1.7 (4.1.8 is outside it); 4.2.0 to 4.2.2 (4.2.3 is outside it) - CVE-2026-61466: 2.6.0 to 3.6.11 (3.6.12 is outside it); 4.0.0 to 4.1.7 (4.1.8 is outside it); 4.2.0 to 4.2.2 (4.2.3 is outside it) - CVE-2026-63687: 2.6.0 to 3.6.11 (3.6.12 is outside it); 4.0.0 to 4.1.7 (4.1.8 is outside it); 4.2.0 to 4.2.2 (4.2.3 is outside it) - CVE-2026-68079: 2.6.0 to 3.6.11 (3.6.12 is outside it); 4.0.0 to 4.1.7 (4.1.8 is outside it); 4.2.0 to 4.2.2 (4.2.3 is outside it) - CVE-2026-68481: 2.6.0 to 3.6.11 (3.6.12 is outside it); 4.0.0 to 4.1.7 (4.1.8 is outside it); 4.2.0 to 4.2.2 (4.2.3 is outside it) - CVE-2026-50631: 2.6.0 to 4.1.6 (4.1.7 is outside it); 4.2.0 to 4.2.1 (4.2.2 is outside it) - CVE-2026-50630: 2.6.0 to 4.1.6 (4.1.7 is outside it); 4.2.0 to 4.2.1 (4.2.2 is outside it) - CVE-2026-50629: 2.6.0 to 4.1.6 (4.1.7 is outside it); 4.2.0 to 4.2.1 (4.2.2 is outside it) - CVE-2026-50628: 2.6.0 to 4.1.6 (4.1.7 is outside it); 4.2.0 to 4.2.1 (4.2.2 is outside it) - CVE-2026-50627: 2.6.0 to 4.1.6 (4.1.7 is outside it); 4.2.0 to 4.2.1 (4.2.2 is outside it) - CVE-2026-50623: 2.6.0 to 4.1.6 (4.1.7 is outside it); 4.2.0 to 4.2.1 (4.2.2 is outside it) ## Advisories (11) ### [CVE-2026-57818](https://cve.now/CVE-2026-57818): Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider - Severity: High 8.1 - Published: Aug 6, 2026 - Affected: from 4.2.0, fixed in 4.2.3; from 4.0.0, fixed in 4.1.8; fixed in 3.6.12. - Fixed in 3.6.12 (released Jul 30, 2026, 7 days before disclosure), 4.1.8 (released Jul 30, 2026, 7 days before disclosure) and 4.2.3 (released Jul 30, 2026, 7 days before disclosure). - The latest release, 4.2.4, is not affected. ### [CVE-2026-61466](https://cve.now/CVE-2026-61466): Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation - Severity: Critical 9.1 - Published: Aug 6, 2026 - Affected: fixed in 3.6.12; from 4.0.0, fixed in 4.1.8; from 4.2.0, fixed in 4.2.3. - Fixed in 3.6.12 (released Jul 30, 2026, 7 days before disclosure), 4.1.8 (released Jul 30, 2026, 7 days before disclosure) and 4.2.3 (released Jul 30, 2026, 7 days before disclosure). - The latest release, 4.2.4, is not affected. ### [CVE-2026-63687](https://cve.now/CVE-2026-63687): Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters - Severity: Critical 9.1 - Published: Aug 6, 2026 - Affected: from 4.2.0, fixed in 4.2.3; from 4.0.0, fixed in 4.1.8; fixed in 3.6.12. - Fixed in 3.6.12 (released Jul 30, 2026, 7 days before disclosure), 4.1.8 (released Jul 30, 2026, 7 days before disclosure) and 4.2.3 (released Jul 30, 2026, 7 days before disclosure). - The latest release, 4.2.4, is not affected. ### [CVE-2026-68079](https://cve.now/CVE-2026-68079): Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay - Severity: Critical 9.8 - Published: Aug 6, 2026 - Affected: from 4.2.0, fixed in 4.2.3; from 4.0.0, fixed in 4.1.8; fixed in 3.6.12. - Fixed in 3.6.12 (released Jul 30, 2026, 7 days before disclosure), 4.1.8 (released Jul 30, 2026, 7 days before disclosure) and 4.2.3 (released Jul 30, 2026, 7 days before disclosure). - The latest release, 4.2.4, is not affected. ### [CVE-2026-68481](https://cve.now/CVE-2026-68481): Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider - Severity: High 7.5 - Published: Aug 6, 2026 - Affected: from 4.2.0, fixed in 4.2.3; from 4.0.0, fixed in 4.1.8; fixed in 3.6.12. - Fixed in 3.6.12 (released Jul 30, 2026, 7 days before disclosure), 4.1.8 (released Jul 30, 2026, 7 days before disclosure) and 4.2.3 (released Jul 30, 2026, 7 days before disclosure). - The latest release, 4.2.4, is not affected. ### [CVE-2026-50631](https://cve.now/CVE-2026-50631): Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing - Severity: High 7.4 - Published: Jun 12, 2026 - Affected: from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.7; fixed in 3.6.12; from 4.2.0, fixed in 4.2.2; fixed in 4.1.7. - Fixed in 4.1.7 (released Jun 5, 2026, 7 days before disclosure) and 4.2.2 (released Jun 4, 2026, 8 days before disclosure). - The latest release, 4.2.4, is not affected. ### [CVE-2026-50630](https://cve.now/CVE-2026-50630): Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection - Severity: Medium 6.5 - Published: Jun 12, 2026 - Affected: from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.7; fixed in 3.6.12; from 4.2.0, fixed in 4.2.2; fixed in 4.1.7. - Fixed in 4.1.7 (released Jun 5, 2026, 7 days before disclosure) and 4.2.2 (released Jun 4, 2026, 8 days before disclosure). - The latest release, 4.2.4, is not affected. ### [CVE-2026-50629](https://cve.now/CVE-2026-50629): Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier - Severity: Medium 5.3 - Published: Jun 12, 2026 - Affected: from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.7; fixed in 3.6.12; from 4.2.0, fixed in 4.2.2; fixed in 4.1.7. - Fixed in 4.1.7 (released Jun 5, 2026, 7 days before disclosure) and 4.2.2 (released Jun 4, 2026, 8 days before disclosure). - The latest release, 4.2.4, is not affected. ### [CVE-2026-50628](https://cve.now/CVE-2026-50628): Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control - Severity: Critical 9.8 - Published: Jun 12, 2026 - Affected: from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.7; fixed in 3.6.12; from 4.2.0, fixed in 4.2.2; fixed in 4.1.7. - Fixed in 4.1.7 (released Jun 5, 2026, 7 days before disclosure) and 4.2.2 (released Jun 4, 2026, 8 days before disclosure). - The latest release, 4.2.4, is not affected. ### [CVE-2026-50627](https://cve.now/CVE-2026-50627): Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator - Severity: Critical 9.1 - Published: Jun 12, 2026 - Affected: from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.7; fixed in 3.6.12; from 4.2.0, fixed in 4.2.2; fixed in 4.1.7. - Fixed in 4.1.7 (released Jun 5, 2026, 7 days before disclosure) and 4.2.2 (released Jun 4, 2026, 8 days before disclosure). - The latest release, 4.2.4, is not affected. ### [CVE-2026-50623](https://cve.now/CVE-2026-50623): Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService - Severity: Medium 4.8 - Published: Jun 12, 2026 - Affected: from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.7; fixed in 3.6.12; from 4.2.0, fixed in 4.2.2; fixed in 4.1.7. - Fixed in 4.1.7 (released Jun 5, 2026, 7 days before disclosure) and 4.2.2 (released Jun 4, 2026, 8 days before disclosure). - The latest release, 4.2.4, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.cxf:cxf-rt-rs-security-oauth2 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.