THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-50627 (CRITICAL 9.1) — The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Rou

[NVD] CVE-2026-50627 (CRITICAL 9.1) — The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Rou

lownvdPublished 2026-06-12

CVE-2026-50627 CVSS: 9.1 CRITICAL Published: 2026-06-12T10:16:22.587

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to

Indicators of compromise

CVE-2026-50627cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-50627