Security Vulnerability in Apache CXF's JwtRequestCodeFilter

CVE-2026-63687

What is CVE-2026-63687?

The JwtRequestCodeFilter in Apache CXF exposes a critical security vulnerability by copying all claims from a signed request JWT into the authorization parameter map, neglecting to exclude security-sensitive parameters. This flaw allows a malicious client that can produce a validly-signed request JWT to manipulate crucial values such as code_challenge, code_challenge_method, nonce, and state that are essential for PKCE integrity and OpenID Connect replay protection. Users are strongly advised to upgrade to the latest versions (4.2.3, 4.1.8, or 3.6.12) to mitigate this risk.

References