Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigured (CVE-2025-66621)
SASL OAuthBearer fails to validate AUD claim in JWT payload when not configured.
40
CVE-2025-66621
JWT AUD claim validation flaw in Apache James SASL OAuthBearer
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache James SASL OAuthBearer/XOAUTH2 fails to validate the AUD claim in JWT payloads when introspection is not configured. An attacker with valid credentials can access the mail server without authorization. This affects users of prior versions before 3.9.1.
What to do: Upgrade to a version forcing explicit AUD claim configuration and introspection. No specific fixed version stated.
| Product | Affected |
|---|---|
| Apache James | prior to 3.9.1 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured. This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so. We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.
- Weakness
- CWE-345