CVE-2026-71575

Overview

Apache CXF is an open-source services framework, maintained by the Apache Software Foundation, for building and consuming web services in Java. It implements the JAX-WS and JAX-RS APIs and supports SOAP, the WS-* standards, RESTful HTTP, and OAuth 2.0 over transports such as HTTP and JMS. Its modules are published as Maven artifacts under org.apache.cxf.

An authorization bypass vulnerability (CVE-2026-71575) has been identified in the OidcClientCodeRequestFilter of the Apache CXF OpenID Connect relying-party module, which allows attackers to sign in with an authentication of any age when the application requires a recent one. A relying party that uses setMaxAgeOffset to force re-authentication silently accepts stale sessions, which bypasses its step-up authentication policy.

Per OWASP: Confirmation of the user's identity, authentication, and session management is critical to protect against authentication-related attacks. There may be authentication weaknesses if the application does not correctly invalidate Session IDs. User sessions or authentication tokens (mainly single sign-on (SSO) tokens) aren't properly invalidated during logout or a period of inactivity.

This issue affects multiple versions of Apache CXF.

Details

Module Info

• Product: Apache CXF
• Affected packages: org.apache.cxf:cxf-rt-rs-security-sso-oidc
• Affected versions: <3.6.13, >=4.0.0 <4.1.9, >=4.2.0 <4.2.4
• GitHub repository: https://github.com/apache/cxf
• Published packages: https://central.sonatype.com/artifact/org.apache.cxf/cxf-rt-rs-security-sso-oidc
• Package manager: Maven
• Fixed in:
  
  • OSS Apache CXF 3.6.13, 4.1.9, 4.2.4
  • NES for Apache CXF v3.4.13, v3.5.14

Vulnerability Info

This Low-severity vulnerability is found in the org.apache.cxf:cxf-rt-rs-security-sso-oidc package in multiple versions of Apache CXF.

OidcClientCodeRequestFilter lets a relying party demand a recent login through its maxAgeOffset setting. When the setting is present, the filter records a value in the code request state before redirecting to the OpenID Provider, and later checks the auth_time claim of the returned ID token against it:

@Override
protected MultivaluedMap<String, String> toCodeRequestState(ContainerRequestContext rc, UriInfo ui) {
    MultivaluedMap<String, String> state = super.toCodeRequestState(rc, ui);
    if (maxAgeOffset != null) {
        state.putSingle(MAX_AGE_PARAMETER, Long.toString(System.currentTimeMillis() + maxAgeOffset));
    }
    return state;
}

private void validateIdToken(IdToken idToken, MultivaluedMap<String, String> state) {
    ...
    if (maxAgeOffset != null) {
        long authTime = Long.parseLong(state.getFirst(MAX_AGE_PARAMETER));
        Long tokenAuthTime = idToken.getAuthenticationTime();
        if (tokenAuthTime > authTime) {
            throw new OAuthServiceException(OAuthConstants.INVALID_REQUEST);
        }
    }
    ...
}

The stored value is a future timestamp in milliseconds, while auth_time is a timestamp in seconds. The comparison is also inverted: it rejects tokens whose authentication is newer than the stored value, not older than the allowed age. Because an auth_time in seconds is always far smaller than a millisecond timestamp, the check never fails, so an ID token whose authentication happened hours or days earlier is accepted. The built-in state managers do not pass max_age to the provider either, so nothing enforces the intended limit.

Mitigation

Only recent versions of Apache CXF are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Apache CXF release line (3.6.x or later) that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Guanping Zhang (finder)