Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-06T11:22:37 org.apache.cxf/cxf-rt-rs-security-oauth2: Apache CXF: Revocation bypass allows unauthorized access 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CWE-303

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and 'introspection of a revoked token MUST return {"active":false}'. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

A flaw was found in Apache CXF. This vulnerability affects the DefaultEncryptingOAuthDataProvider, where revoked access and refresh tokens can still be successfully decrypted and reported as active. This bypasses the intended token revocation process, potentially allowing unauthorized access to systems or data even after a user's permissions have been withdrawn.

Moderate: This flaw in Apache CXF's OAuth2 token handling allows previously revoked access and refresh tokens to remain valid. This bypasses intended revocation mechanisms, potentially enabling unauthorized access to resources in applications deployed on affected Red Hat platforms that utilize the DefaultEncryptingOAuthDataProvider. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat build of Apache Camel for Spring Boot 4 Fix deferred cxf-rt-rs-security-oauth2 Red Hat JBoss Enterprise Application Platform Expansion Pack Fix deferred cxf-rt-rs-security-oauth2 Red Hat JBoss Web Server 5 Fix deferred cxf-rt-rs-security-oauth2 https://www.cve.org/CVERecord?id=CVE-2026-68481 https://nvd.nist.gov/vuln/detail/CVE-2026-68481 https://lists.apache.org/thread/88c0h10yjb2b8201o1km3st71fs2zw2b