CVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter
Apache CXF's OIDC max_age freshness check failed due to a unit bug (CVE-2026-71575).
The max_age authentication-freshness check in Apache CXF's OidcClientCodeRequestFilter was inoperative because of a milliseconds-versus-seconds unit mismatch and an inverted comparison. The bug affects cxf-rt-rs-security-sso-oidc before 3.6.13, 4.0.0 before 4.1.9, and 4.2.0 before 4.2.4. The reporter rated severity low. No in-the-wild exploitation is described.
- CVE-2026-71575 disables CXF's OIDC max_age freshness check.
- A milliseconds/seconds mismatch and inverted comparison cause it.
- Patched in Apache CXF 3.6.13, 4.1.9, and 4.2.4.
- CVEs
- CVE-2026-71575
- Vendors
- Apache
- Products
- Apache CXF
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-71575 | Inoperative max_age freshness check in Apache CXF OIDC | 9.1 | — |
From the original article
Posted by Colm O hEigeartaigh on Oct 09 Severity: low Affected versions: - Apache CXF (org. apache. cxf:cxf-rt-rs-security-sso-oidc) 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.