CVE
CVE-2026-61466
Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Package Versions Affected
Package Version
patch Availability
No items found.
Automatically patch vulnerabilities without upgrading
Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request
CVSS Version
Severity
Base Score
CVSS Version
Score Vector
C
H
U
9.1
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
C
H
U
-
Related Resources
No items found.
References
http://www.openwall.com/lists/oss-security/2026/08/06/21, https://repo.maven.apache.org/maven2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61466.json, https://lists.apache.org/thread/2l1r16g79tpxd7fzrzr2q9oscwrjgljs, https://nvd.nist.gov/vuln/detail/CVE-2026-61466