Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-63687: Apache CXF JWT Filter Exposes Security-Sensitive Data

CVE-2026-63687 · published 3 months ago

Summary

Apache CXF's JWT filter copies sensitive data from JWTs into the authorization map. This allows malicious clients to manipulate security parameters, compromising PKCE and OpenID Connect protection. To fix this, update to Apache CXF versions 4.2.3, 4.1.8, or 3.6.12.

What to do

Update apache software foundation apache cxf to version 4.2.3 or later.

Affected software

Vendor	Product	Affected versions
apache software foundation	apache cxf	< 4.2.3
apache	cxf	< 3.6.12 >= 4.0.0, < 4.1.8 >= 4.2.0, < 4.2.3 `cpe:2.3:a:apache:cxf::::::::`

Original advisory text

Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, code_challenge_method, nonce, and state values that were set in the outer HTTP request, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

References

https://lists.apache.org/thread/drcq4chmt0btx86f17o47j17r378hzpw Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/06/22 URL
https://repo.maven.apache.org/maven2 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63687... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-63687 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.1 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-345Insufficient Verification of Data Authenticity

Timeline

Published6 Aug 2026

Updated3 Nov 2026

First seen6 Aug 2026

Sources

CVE-2026-63687 · NVD

CVE-2026-63687 · MITRE

CVE-2026-63687 · OSV

Track software like this

Free during beta