Skip to content
VulniPulse
Sign in
Advisory severityCritical9.1Apache Software Foundation

Critical [CVE-2026-61466] In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist

This critical-severity Apache Software Foundation advisory covers CVE-2026-61466 affecting Apache CXF.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-61466 Source published Source updated

VulniPulse record published Record updated

CVE-2026-61466
Affected products & platforms
Apache Software FoundationUnclassified
Open source advisory

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time.

Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Affected versions
  • Apache CXF before 3.6.12
  • Apache CXF 4.0.0 before 4.1.8
  • Apache CXF 4.2.0 before 4.2.3

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions
  • 4.2.3
  • 4.1.8
  • 3.6.12

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.