Vulnerability · Published Oct 9, 2026 · Assigned by apache
CVE-2026-71575Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter
Critical 9.1
In plain English
A critical-severity security flaw in Apache CXF from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Official description
The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache CXF | 4.2.0 – before 4.2.44.0.0 – before 4.1.90 – before 3.6.13 |
Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N