Severity: low
Affected versions:
- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) 4.2.0 before 4.2.3
- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) 4.0.0 before 4.1.8
- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) before 3.6.12
Description:
In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still
decrypt successfully, and TokenIntrospectionService reports active:true. The
same applies to refresh tokens. This violates the RFC stipulations that 'The
authorization server MUST invalidate the token.' and 'introspection of a
revoked token MUST return {"active":false}'. Users are recommended to upgrade
to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Credit:
Guanping Zhang reported this vulnerability (finder)
References:
https://cxf.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-68481
