An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7, which fixes this issue.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/ydzj8m5mqmjy13xgyj9mkk9hfff63qq7 | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/06/11/3 | Mailing List Third Party Advisory |
Configurations
History
12 Jun 2026, 19:07
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.apache.org/thread/ydzj8m5mqmjy13xgyj9mkk9hfff63qq7 - Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/06/11/3 - Mailing List, Third Party Advisory | |
| First Time |
Apache cxf
Apache |
|
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* |
12 Jun 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
12 Jun 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-12 10:16
Updated : 2026-06-12 19:07
NVD link : CVE-2026-50623
Mitre link : CVE-2026-50623
CVE.ORG link : CVE-2026-50623
JSON object : View
Products Affected
apache
- cxf
CWE