CVE-2026-50634: Apache CXF JwsJsonContainerRequestFilter Authentication Bypass

Technical summary

CVE-2026-50634 is an authentication bypass vulnerability in Apache CXF versions prior to 4.2.2 and 4.1.7. The JwsJsonContainerRequestFilter fails to properly validate that all request metadata (specifically Content-Type headers and other HTTP headers) included in downstream processing originated from the cryptographically verified JWS signature. An attacker can craft a request where the filter accepts the signature but the unsigned or differently-signed metadata is processed as if it were authenticated. This violates the principle that accepted headers must come from a verified signature entry, and can cause inconsistencies between JAX-RS entity parsing expectations and the actual request state. The vulnerability is classified as CWE-347 (Improper Verification of Cryptographic Signature).

Business impact

This vulnerability permits attackers to manipulate request metadata without cryptographic proof of authorization, potentially leading to: (1) unauthorized access to sensitive data by spoofing Content-Type to trigger unintended parsing paths; (2) bypassing header-based security controls that rely on signature verification; (3) injection attacks in downstream services that trust the metadata validation. Organizations relying on CXF's JWS signing mechanisms for API security may inadvertently grant attackers the ability to craft requests that pass filter checks but violate application-level security policies.

Affected systems

Apache CXF versions prior to 4.2.2 (4.2.x branch) and prior to 4.1.7 (4.1.x branch) are affected. Any Java application using CXF for REST/SOAP services with JwsJsonContainerRequestFilter enabled and relying on JWS authentication for request metadata integrity is in scope. The vulnerability does not require network authentication or user interaction, making it exploitable by unauthenticated remote attackers.

Exploitability

The vulnerability has a CVSS 3.1 score of 6.5 (MEDIUM severity) with a network vector (AV:N), low attack complexity (AC:L), and no privilege requirement (PR:N). This indicates the flaw is remotely exploitable and does not demand specialized conditions or elevated privileges to trigger. The attack does not require user interaction. However, exploitation requires understanding of CXF's JWS validation flow and crafting requests that pass the filter but violate application assumptions. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog, suggesting active exploitation in the wild has not been officially confirmed at this time.

Remediation

Upgrade to Apache CXF version 4.2.2 or later for the 4.2.x branch, or to version 4.1.7 or later for the 4.1.x branch. These versions contain fixes that ensure metadata (Content-Type, HTTP headers) is only accepted when cryptographically verified by the JWS signature. Prior to upgrading, organizations should audit their CXF configurations and downstream request processing to identify dependencies on signature-verified metadata.

Patch guidance

Apply the official Apache CXF security update from the project's release channels. For 4.2.x deployments, deploy version 4.2.2 or a later 4.2.z release. For 4.1.x deployments, deploy version 4.1.7 or a later 4.1.z release. Verify patch application by checking the CXF library version in your classpath and confirming changelog entries for this CVE in the release notes. Test in a staging environment first, as authentication and header validation changes may affect existing request handling logic.

Detection guidance

Monitor for requests to endpoints protected by JwsJsonContainerRequestFilter where Content-Type or critical HTTP headers differ from what would be expected in the JWS signature payload. Look for discrepancies between signed and unsigned metadata in request logs. Implement request validation rules that re-verify header consistency after CXF processing. Security Information and Event Management (SIEM) rules can be configured to flag requests with mismatched or unexpectedly modified metadata. Conduct code review of downstream services consuming metadata from CXF filters to ensure they do not assume all processed headers are signature-verified.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), this vulnerability warrants timely patching because: (1) it is remotely exploitable without authentication; (2) it undermines the security guarantees of cryptographic signature verification; (3) the impact spans both confidentiality and integrity; (4) many organizations use CXF for service-to-service API authentication, making metadata spoofing a direct bypass of trust boundaries. Prioritize patching if your services rely on JWS-signed requests for access control.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L), no privilege requirement (PR:N), and no user interaction needed (UI:N). Impact is limited to low confidentiality and low integrity loss (C:L, I:L) with no availability impact (A:N), and scope is unchanged (S:U). The score lands in the MEDIUM range, appropriately reflecting that while the attack is easy to perform and the flaw is fundamental to authentication, actual impact depends on downstream application logic and what sensitive operations depend on verified metadata.

Frequently asked questions