Access Token Service Vulnerability in Apache CXF

CVE-2019-12419

Summary

Apache CXF versions prior to 3.3.4 and 3.2.11 are susceptible to a vulnerability in their access token services. The vulnerability arises from a lack of proper validation to ensure that the authenticated principal corresponds with the clientId parameter provided in the request. This flaw can be exploited by a malicious client that has managed to acquire an authorization code issued to a different client, enabling them to retrive access tokens intended for that other client, thus compromising the security of the application.

References