Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigured (CVE-2025-66621)
SASL OAuthBearer fails to validate AUD claim in JWT payload when not configured.
Stories per day · 30 days
2 RSS
Relatedapache3authentication3jwt3apache-kafka2oauth2amqp1apache-tomcat1authentication-bypass1authorization1bypass1fail-open1jabberd21james1jndirealm1oauthbearer1qpid-proton1token-validation1zookeeper1
8 stories, newest first · one card per story
Stories tagged #sasl
Apache ZooKeeper SASL authorization bypass on client port (CVE-2026-100252)
Affects 3.8.0-3.9.6; client-supplied authzid bypasses SASL checks
jabberd2 authentication bypass vulnerability
jabberd2 allows SASL ANONYMOUS authentication even when disabled in configuration.
Qpid Proton C through 0.40.0 can treat AMQP frames as SASL
Apache calls the flaw important: peers can send regular AMQP frames that Proton dispatches as SASL, with no username set.
Kafka skips JWT signature checks when JWKS URL is unset (CVE-2026-110985)
DefaultJwtValidator verifies signatures only if sasl.oauthbearer.jwks.endpoint.url is set; that setting is unset by default.
Tomcat JNDIRealm auth fails open for non-GSSAPI SASL (CVE-2026-101296)
Apache rates the flaw important across Tomcat 7 through 11 ranges when JNDIRealm uses non-GSSAPI SASL.
Unfixed vulnerabilities in Cyrus SASL
Publicly reported Cyrus SASL security issues remain unfixed, with no maintainer response and no release since 2022.
CVE-2026-86219: Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step
Authen::SASL::Perl::DIGEST_MD5 before 2.2100 for Perl accepts replayed DIGEST-MD5 authentication responses via unverified nonce handling (CVE-2026-86219).