Authorization Server Vulnerability in Apache CXF OAuth2 Registration

CVE-2026-61466

What is CVE-2026-61466?

The Apache CXF OAuth2 Dynamic Client Registration endpoint allows the authorization server to accept and store the 'scope' value from client registration requests without proper validation against a predefined allowlist. This design flaw could pose a risk, as it enables clients to self-assign privileged scopes during the registration process. It is critical for users to ensure they upgrade to versions 4.2.3, 4.1.8, or 3.6.12 to mitigate potential security threats.

References