CVE-2026-68079, CVE-2026-61466, CVE-2026-63687, CVE-2026-65583, CVE-2026-57817, CVE-2026-57818, CVE-2026-68481

Data: 2026-08-07

Severity: Critical

CVSS Score:

CVE-2026-68079: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVE-2026-61466: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVE-2026-63687: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVE-2026-65583: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVE-2026-57817: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVE-2026-57818: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVE-2026-68481: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Nota

La severity e i CVSS Score si riferiscono alle vulnerabilità della libreria. Come descritto nella sezione GovWay, le vulnerabilità non si manifestano nel prodotto, poiché risiedono nei moduli cxf-rt-rs-security-oauth2 (server OAuth2 di Apache CXF) e cxf-rt-rs-security-sso-oidc (relying party OpenID Connect di Apache CXF), non distribuiti da GovWay.

Riferimenti:

CVE-2026-68079:
- https://nvd.nist.gov/vuln/detail/CVE-2026-68079
- https://cxf.apache.org/security-advisories.data/CVE-2026-68079.txt
CVE-2026-61466:
- https://nvd.nist.gov/vuln/detail/CVE-2026-61466
- https://cxf.apache.org/security-advisories.data/CVE-2026-61466.txt
CVE-2026-63687:
- https://nvd.nist.gov/vuln/detail/CVE-2026-63687
- https://cxf.apache.org/security-advisories.data/CVE-2026-63687.txt
CVE-2026-65583:
- https://nvd.nist.gov/vuln/detail/CVE-2026-65583
- https://cxf.apache.org/security-advisories.data/CVE-2026-65583.txt
CVE-2026-57817:
- https://nvd.nist.gov/vuln/detail/CVE-2026-57817
- https://cxf.apache.org/security-advisories.data/CVE-2026-57817.txt
CVE-2026-57818:
- https://nvd.nist.gov/vuln/detail/CVE-2026-57818
- https://cxf.apache.org/security-advisories.data/CVE-2026-57818.txt
CVE-2026-68481:
- https://nvd.nist.gov/vuln/detail/CVE-2026-68481
- https://cxf.apache.org/security-advisories.data/CVE-2026-68481.txt

Libreria: org.apache.cxf:cxf-rt-rs-security-oauth2, org.apache.cxf:cxf-rt-rs-security-sso-oidc (versioni affette: < 3.6.12, 4.0.0 - 4.1.7 e 4.2.0 - 4.2.2)

Descrizione

Le sette vulnerabilità riguardano i moduli cxf-rt-rs-security-oauth2 e cxf-rt-rs-security-sso-oidc di Apache CXF, ovvero l’implementazione del server OAuth2 (Authorization Server, endpoint di introspection, gestione dei code e dei token) e quella del relying party OpenID Connect.

[CVE-2026-68079] CWE-294: Authentication Bypass by Capture-replay

In Apache CXF’s DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that «The authorization code MUST NOT be used more than once.» Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

[CVE-2026-61466] CWE-304: Missing Critical Step in Authentication

In Apache CXF’s OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

[CVE-2026-63687] CWE-345: Insufficient Verification of Data Authenticity

Apache CXF’s JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, code_challenge_method, nonce, and state values that were set in the outer HTTP request, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

[CVE-2026-65583] CWE-345: Insufficient Verification of Data Authenticity

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.

[CVE-2026-57817] CWE-20: Improper Input Validation

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the c_hash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the c_hash, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

[CVE-2026-57818] CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.

[CVE-2026-68481] CWE-672: Operation on a Resource after Expiration or Release

In Apache CXF’s DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that “The authorization server MUST invalidate the token.” and “introspection of a revoked token MUST return {«active»:false}”. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

GovWay

Le sette vulnerabilità risiedono nei moduli con cui Apache CXF implementa il ruolo di Authorization Server OAuth2 (rilascio ed introspection dei token, gestione dei DataProvider per code e refresh token, registrazione dinamica dei client) e quello di relying party OpenID Connect (validazione degli ID token restituiti da un Identity Provider esterno).

Tali moduli non fanno parte della distribuzione di GovWay: il prodotto non espone alcun Authorization Server OAuth2 basato su Apache CXF, né utilizza il relying party OIDC di CXF. La gestione dei token in GovWay (validazione JWT, introspection e userinfo verso Identity Provider esterni, negoziazione dei token, PDND) è realizzata con logica propria, indipendente dai moduli OAuth2/OIDC di CXF; di Apache CXF viene utilizzato unicamente il modulo cxf-rt-rs-security-jose per le operazioni crittografiche su JOSE (JWS/JWE), non interessato da queste vulnerabilità. Per questi motivi le vulnerabilità non si manifestano nel prodotto.

Nota

Le vulnerabilità sono segnalate dai tool di analisi delle dipendenze (es. OWASP dependency-check) a carico degli artefatti cxf-core e cxf-rt-transports-http-jetty, in quanto l’NVD associa le vulnerabilità di Apache CXF alla CPE di prodotto cpe:2.3:a:apache:cxf senza distinguere il singolo modulo Maven. Il codice vulnerabile risiede tuttavia nei moduli cxf-rt-rs-security-oauth2 e cxf-rt-rs-security-sso-oidc, non distribuiti da GovWay.

Versione affette:

3.3.x: <= 3.3.20
3.4.x: <= 3.4.3

Risoluzione:

3.3.x: 3.3.21
3.4.x: 3.4.4