CVE-2026-50623: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService

[Colm O hEigeartaigh <coheigea () apache org>]

Severity: moderate 

Affected versions:

- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) 4.2.0 before 4.2.2
- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) before 4.1.7

Description:

An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 
'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed 
by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to 
enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7, which fixes this 
issue.

Credit:

Guanping Zhang reported this vulnerability. (finder)

References:

https://cxf.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-50623