VDB
KO
CRITICAL 9.1

GHSA-9mrv-8pvf-hf4m

Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

Quick fix

GHSA-9mrv-8pvf-hf4m — org.apache.cxf:cxf-rt-rs-security-oauth2: upgrade to the fixed version with the command below. 

# pom.xml: bump <version>4.2.2</version> for org.apache.cxf:cxf-rt-rs-security-oauth2

Details

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven / org.apache.cxf:cxf-rt-rs-security-oauth2
Introduced in: 4.2.0 Fixed in: 4.2.2
Fix # pom.xml: bump <version>4.2.2</version> for org.apache.cxf:cxf-rt-rs-security-oauth2
Maven / org.apache.cxf:cxf-rt-rs-security-oauth2
Introduced in: 0 Fixed in: 4.1.7
Fix # pom.xml: bump <version>4.1.7</version> for org.apache.cxf:cxf-rt-rs-security-oauth2

References