← All credits
Guanping Zhang reported this vulnerability.
9 vulnerability records and advisories credit this contributor.
CVE-2026-50627
Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator
CVE-2026-50631
Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing
CVE-2026-50630
Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection
CVE-2026-50629
Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier
CVE-2026-50623
Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
CVE-2026-57817
Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow
CVE-2026-65583
Apache CXF: Self-issued ID token claims validation skipped
CVE-2026-63687
Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters
CVE-2026-61466
Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation