CVE-2026-71575
The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a…
- Risk score
- 66/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 9 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication pol…
- Affected
- Apache Cxf before 4.2.4, 4.1.9, 3.6.13
- Fix
- Upgrade Apache Cxf to 4.2.4, 4.1.9 or 3.6.13 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
Original description
The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Last activity 9 Oct 2026. Patch Forecast updates every hour.