CVE-2026-68481 Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider
Attackers can use revoked OAuth tokens because the library fails to invalidate them, allowing unauthorized access despite revocation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68481?
CVE-2026-68481 is a high-severity vulnerability in Apache Cxf, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and 'introspection of a revoked token MUST return {"active":false}'. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Weakness: CWE-672
Which versions are affected by CVE-2026-68481?
It affects 1 product.
Products include Apache Cxf.
How do I fix CVE-2026-68481?
Upgrade to a fixed version.
Is CVE-2026-68481 being exploited?
There is no known exploitation of CVE-2026-68481 in the wild and no public exploit code.
Other vulnerabilities in Apache Cxf
- CVE-2012-2379 XML Signature/Encryption Not Validated in Apache CXF
- CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
- CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
- CVE-2026-50628 Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
- CVE-2025-48913 Apache CXF: Untrusted JMS configuration can lead to RCE
Sources
Also known as GHSA-5c8v-93q6-cjxj.