CVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider

[Colm O hEigeartaigh <coheigea () apache org>]

Severity: low 

Affected versions:

- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) 4.2.0 before 4.2.3
- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) 4.0.0 before 4.1.8
- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) before 3.6.12

Description:

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and 
TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations 
that 'The authorization server MUST invalidate the token.' and 'introspection of a revoked token MUST return 
{"active":false}'. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Credit:

Guanping Zhang reported this vulnerability (finder)

References:

https://cxf.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-68481