Riskcovery

CVE-2026-61466

Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation

State
Published
Severity
9.1 Critical
Published
Aug 6, 2026
Updated
Aug 7, 2026
Reserved
Jul 9, 2026

Read the record on cve.org

Description

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Scores

CVSSScoreVectorSource
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HCISA-ADP

Weaknesses

  • CWE-304 Missing Critical Step in Authentication

Affected Products

ProductVersions
Apache CXFApache Software Foundation
  • before 3.6.12Affected
  • 4.0.0 to before 4.1.8Affected
  • 4.2.0 to before 4.2.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.