Authentication Bypass Vulnerability in OidcClientCodeRequestFilter from Apache
CVE-2026-71575

9.1CRITICAL

Key Information:

Vendor

Apache
Status
Apache Cxf
Vendor
CVE Published:
9 October 2026

What is CVE-2026-71575?

A critical flaw exists in the authentication freshness check of the OidcClientCodeRequestFilter, caused by a mismatch in time unit handling and a reversed logic condition. This vulnerability allows relying parties that utilize setMaxAgeOffset for re-authentication to inadvertently accept sessions of any age, circumventing established step-up authentication protocols. It is crucial for users to upgrade to the recommended versions to secure their applications against this vulnerability.

Affected Version(s)

Apache CXF 4.2.0 < 4.2.4

Apache CXF 4.0.0 < 4.1.9

Apache CXF 0 < 3.6.13

References

https://lists.apache.org/thread/p1r9t4xl8ny7rg8wmj8nrygx3...
vendor-advisory

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Guanping Zhang reported this vulnerability
.