中文

// CVE · PUBLISHED 2026-10-09

CVE-2026-71575

Apache Software Foundation / Apache CXF

9.1 · CVSS 3.1Critical

Description

The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

References

Related CVEs

  • CVE-2026-103513Apache Software Foundation / Apache DataSketchesCVSS 9.8
  • CVE-2026-103501Apache Software Foundation / Apache DataSketchesCVSS 9.8
  • CVE-2026-86405Sipay Electronic Money and Payment Services Inc. / PrestaShop Virtual POS ModuleCVSS 9.8
  • CVE-2026-85531Sipay Electronic Money and Payment Services Inc. / OpenCart Virtual POS ModuleCVSS 9.8
  • CVE-2026-97468Apache Software Foundation / Apache CXFCVSS 9.1
  • CVE-2026-107938Apache Software Foundation / Apache CXFCVSS 9.1
  • CVE-2026-96809MultiNet Interactive AB / EduAdmin BookingCVSS 9.3
  • CVE-2026-96331wpdreams / Ajax Search ProCVSS 9.3

← CVE Index: search every CVE from the last 30 days

This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.