VulnSocial

CVE-2026-50623Disclosure(apache / cxf)

LOWCVSS 4.8 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch apache cxf systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • cxf

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-06-12); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
apache
Products
cxf

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-12: 2Mentions · 2026-06-15: 1Patch / Workaround · 2026-06-15: 1Technical Details · 2026-06-12: 2Technical Details · 2026-06-15: 106-1206-15
Signal classification1 categories
Disclosure
3100.0%
Referenced assets2 URLs
By indicator
Classification over time
DateTotalLabels
2026-06-122
Disclosure2
2026-06-151
Disclosure1
Full discourse3 posts
  • Can Artuc@canartuc
    Disclosure

    Apache CXF's security advisory page lists more than a dozen 2026 CVEs in its OAuth2 and JAX-WS paths, headlined by CVE-2026-50623, an authentication bypass in the OAuth2 TokenIntrospectionService. If you run CXF services, the advisory page is worth a careful pass. Patched yet?

    Post summary

    The tweet announces the existence of CVE-2026-50623, an authentication bypass in Apache CXF, and directs users to review the advisory page for patches. No exploit or active usage is reported.

    0000026
    172 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-50623 An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, t… https://www.cve.org/CVERecord?id=CVE-2026-50623 ----- Traducción: CVE-2026-50623 Exi… http://infoflow.cloud`

    Post summary

    The tweet announces CVE-2026-50623, an authentication bypass in Apache CXF’s OAuth2 TokenIntrospectionService due to a missing 'throw' keyword, but offers no PoC, exploit code, or patch information.

    0000022
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-50623 An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, t… https://www.cve.org/CVERecord?id=CVE-2026-50623

    Post summary

    The post announces CVE-2026-50623 as an authentication bypass vulnerability in Apache CXF’s OAuth2 TokenIntrospectionService due to a missing throw keyword.

    00000193
    57.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachecxf---

Explore more

Back to dashboardapache CVEscxf vulnerabilities