CVE-2026-50623

CVE-2026-50623

An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed b…

Vulnerability class: Broken Authentication

Weakness classification (CWE)

References