CVE-2026-71575
Description
A flaw was found in Apache CXF. The authentication freshness verification mechanism in the OpenID Connect (OIDC) client filter fails to properly evaluate session age due to a unit mismatch and flawed comparison logic. A remote attacker with a stale or expired session can exploit this issue to bypass re-authentication and step-up authentication requirements, maintaining unauthorized access to protected resources.
Statement
This vulnerability is rated as having Moderate impact because exploitation requires the attacker to possess an existing valid session, and it only affects deployments where applications explicitly enforce session freshness through step-up authentication policies using OpenID Connect client filters. In standard deployments, core authentication and initial access controls remain enforced. Consequently, the flaw does not permit initial unauthorized access or elevation of privileges beyond what the existing user account already possesses.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.4 | N/A | 9.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | High |
| Integrity Impact | Low | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Access Control,Integrity
Technical Impact: Gain Privileges or Assume Identity
This weakness may improve the likely success of certain attacks. For example, an attacker may intercept a session ID, possibly via a network sniffer or Cross-site Scripting attack. Although short session expiration times do not help if a stolen token is immediately used, they will protect against ongoing replaying of the session ID. In another scenario, a user might access a web site from a shared computer (such as at a library, Internet cafe, or open work environment), but forget to close the pages before leaving. A long expiration could allow an attacker to use the browser's back button to access web pages previously accessed by the victim.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
