CVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter
Apache CXF's OIDC max_age freshness check failed due to a unit bug (CVE-2026-71575).
30
Vulnerability2 · 1 read
CVE-2026-71575
Inoperative max_age freshness check in Apache CXF OIDC
- CVSS 3.1
- 9.1 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache CXF's OidcClientCodeRequestFilter fails to enforce the max_age authentication-freshness check because of a milliseconds-versus-seconds unit mismatch and an inverted comparison. Relying parties that use setMaxAgeOffset to require re-authentication therefore silently accept sessions of any age. An attacker who can present an old session can bypass step-up authentication policies that should have forced a fresh login. Deployments of the affected Apache CXF releases that enable this check are impacted. There is no known public proof of concept and no evidence of exploitation in the wild.
What to do: Upgrade Apache CXF to 4.2.4, 4.1.9, or 3.6.13. Until then, do not rely on setMaxAgeOffset for step-up or re-authentication, and after upgrading confirm that stale sessions are actually rejected by the max_age policy.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache CXF | Releases fixed in 4.2.4, 4.1.9, and 3.6.13; earlier versions in those lines that use the max_age check are affected |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.