VulnSocial

CVE-2026-50627Disclosure(apache / cxf)

LOWCVSS 9.1 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

apache CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-289CWE-303

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • cxf

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
apache
Products
cxf

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-06-12: 2Technical Details · 2026-06-12: 206-12
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-50627 The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource… https://www.cve.org/CVERecord?id=CVE-2026-50627 ----- Traducción: CVE-2026-50627 La … http://infoflow.cloud`

    Post summary

    The tweet briefly announces CVE‑2026‑50627, noting that Apache CXF’s JwtAccessTokenValidator does not validate the audience claim of JWTs; no additional exploitation or remediation details are provided.

    0000019
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-50627 The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource… https://www.cve.org/CVERecord?id=CVE-2026-50627

    Post summary

    The post announces a flaw in Apache CXF where the 'aud' claim of JWTs is not validated, with no evidence of exploitation, PoC, or patch information.

    00000169
    57.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachecxf---

Explore more

Back to dashboardapache CVEscxf vulnerabilities