Vulnerability · Published Aug 6, 2026 · Assigned by apache
CVE-2026-61466Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
Critical 9.1
In plain English
A critical-severity security flaw in Apache CXF from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache CXF | 0 – before 3.6.124.0.0 – before 4.1.84.2.0 – before 4.2.3 |
Weakness: CWE-304 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H