CVE-2026-61466

Katalog CVE

CVSS 9.1 · Critical EPSS 0,71%

Kerentanan Missing Critical Step in Authentication pada apache cxf. Skor CVSS 3.1 9.1 (Critical) menurut CISA ADP.

Deskripsi (NVD)

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Rincian

Terbit di NVD

6 Agustus 2026

Terakhir diubah

7 Agustus 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-304: Missing Critical Step in Authentication

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/2l1r16g79tpxd7fzrzr2q9oscwrjgljs mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/08/06/21