CVE-2026-71575

UNKNOWN 0.0

Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

CWE	CWE-613
Vendor	apache software foundation
Product	apache cxf
Published	Oct 9, 2026
Last Updated	Oct 9, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache cxf

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache cxf are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache CXF

4.2.0 < 4.2.4 4.0.0 < 4.1.9 0 < 3.6.13

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/p1r9t4xl8ny7rg8wmj8nrygx35ds6vcs openwall.com: http://www.openwall.com/lists/oss-security/2026/10/09/4

Credits

Guanping Zhang reported this vulnerability