CVE-2026-50627: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator

Synopsis

Missing JWT audience and issuer validation in Apache CXF's JwtAccessTokenValidator class allows a token confusion attack, also called a JWT replay or routing attack. An attacker with access to a valid JWT issued for one resource server can present that token to a completely different resource server, bypassing authorization checks entirely. Successful exploitation gives the attacker full read, write, and availability impact on any resource server that accepts the replayed token. Patched-image rebuilds at versions 4.1.7 and 4.2.2 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target resource server's token-validation endpoint over the network, so the service must be exposed to a network the attacker can access.

• AuthenticationRequired

  The attacker must possess a valid JWT previously issued by a legitimate authorization server, meaning they need at minimum a low-privilege account on any resource server in the same trust domain to obtain such a token.

• Victim interactionNot required

  No user interaction is required; the attacker replays the token directly against the target service without any victim action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special race conditions, memory layout requirements, or environmental constraints beyond obtaining a valid JWT.

Blast Radius

• Reads protected resources and data on any resource server that accepts the replayed token, including records and credentials scoped to legitimate users.
• Modifies or deletes persisted data on affected resource servers because the token grants write-equivalent authorization.
• Disrupts service availability on affected resource servers through authorized destructive API calls permitted by the replayed token's scope.
• Lateral movement across multiple resource servers sharing the same authorization server is possible if each server fails to enforce audience validation.