CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 9868

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter

Apache CXF contains a bug in the OidcClientCodeRequestFilter where the max_age authentication-freshness check does not function due to a unit mismatch between milliseconds and seconds and an inverted comparison. Affected versions include CXF 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and before 3.6.13. The severity is rated low.

Why it matters: Organizations using Apache CXF for OpenID Connect (OIDC) authentication should update to patched versions (4.2.4, 4.1.9, or 3.6.13) to ensure the max_age freshness check operates correctly and prevents use of stale authentication credentials.

CVEsCVE-2026-71575
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary