Access token validation errors affects all versions of Apache CXF prior to 3.3.4 and 3.2.11.

Free Trial

Access token validation errors affects all versions of Apache CXF prior to 3.3.4 and 3.2.11.

http://marionjensen.com/2005/01 Overview :

Apache CXF OpenId Connect token service does not properly validate the clientId

http://venturearchitecture.com/live/albion-street Affected Product(s) :

Apache CXF prior to 3.3.4 and 3.2.11.

Vulnerability Details :

CVE ID :

CVE-2019-12419

Apache CXF provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied

If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.

Solution :

Users of Apache CXF that rely on the OpenId Connect service should update to either the 3.3.4 or 3.2.11 releases.

Access token validation errors affects all versions of Apache CXF prior to 3.3.4 and 3.2.11.

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2024-6121 : NI SYSTEMLINK SERVER/FLEXLOGGER REDIS VULNERABLE THIRD-PARTY COMPONENT

CVE-2024-40634 : ARGOPROJ ARGO-CD UP TO 2.9.19/2.10.14/2.11.5 /API/WEBHOOK RESOURCE CONSUMPTION

CVE-2024-39685 : FISHAUDIO BERT-VITS2 UP TO 2.3 RESAMPLE DATA_DIR OS COMMAND INJECTION