Descrição
In Apache CXF-s DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that -The authorization server MUST invalidate the token.- and -introspection of a revoked token MUST return {-active-:false}-. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
CVSS 7.5EPSS 0.42500000000000004%Risco 0.78
Ver fonte- Publicação
- 2026-08-06 12:16:28
- Última alteração
- 2026-08-07 00:16:40
- Vetor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N