OAuth2 Vulnerability in Apache James Mail Server

CVE-2025-66621

What is CVE-2025-66621?

Prior versions of Apache James SASL OAuthBearer/XOAUTH2, specifically those released before version 3.9.1, are susceptible to an improper authentication vulnerability. This occurs due to inadequate validation of the AUD claim within JSON Web Token (JWT) payloads, particularly when introspection settings are not configured. As a result, an attacker with valid credentials could potentially gain unauthorized access to the mail server. Users are advised to update their systems to versions that enforce proper AUD claim configuration and require introspection to mitigate this risk.

References