CVE-2026-61466

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61466
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61466.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61466
Published
2026-08-06T11:24:27.466Z
Modified
2026-08-12T03:51:47.077909796Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
Details

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-304"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61466.json",
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "3.6.12"
                },
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "4.1.8"
                },
                {
                    "introduced": "4.2.0"
                },
                {
                    "fixed": "4.2.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/apache/cxf

Affected ranges

Type
GIT
Repo
https://github.com/apache/cxf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
16d606b3c4d5c7d271fd3b488c60a208586acb3f
Introduced
02310e95fe74c0c031f540f3284e4a9bd856ced2
Fixed
8797a177ec23e9c578c78a630c154ad27d9bbe8d
Introduced
04ccbfd709eef8f4af53d6237514fbe9db7ea81f
Fixed
33259395b45b4ff69b8df6a153630721fdd489fa
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.6.12"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.1.8"
        },
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.2.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

cxf-2.*
cxf-2.1
cxf-2.1.2
cxf-2.2
cxf-2.2.1
cxf-2.2.2
cxf-2.3.0
cxf-2.4.0
cxf-2.5.0
cxf-2.5.1
cxf-2.6.0
cxf-2.6.1
cxf-2.7.0
cxf-2.7.1
cxf-2.7.2
cxf-3.*
cxf-3.0.0
cxf-3.0.0-milestone2
cxf-3.1.0
cxf-3.1.1
cxf-3.1.2
cxf-3.1.3
cxf-3.1.4
cxf-3.2.0
cxf-3.2.1
cxf-3.2.2
cxf-3.2.3
cxf-3.2.4
cxf-3.2.5
cxf-3.3.0
cxf-3.3.1
cxf-3.3.2
cxf-3.3.3
cxf-3.4.0
cxf-3.4.1
cxf-3.5.0
cxf-3.6.0
cxf-3.6.1
cxf-3.6.10
cxf-3.6.11
cxf-3.6.2
cxf-3.6.3
cxf-3.6.4
cxf-3.6.5
cxf-3.6.6
cxf-3.6.7
cxf-3.6.8
cxf-3.6.9
cxf-4.*
cxf-4.0.0
cxf-4.0.1
cxf-4.0.2
cxf-4.0.3
cxf-4.0.4
cxf-4.1.0
cxf-4.1.1
cxf-4.1.2
cxf-4.1.3
cxf-4.1.4
cxf-4.1.5
cxf-4.1.6
cxf-4.1.7
cxf-4.2.0
cxf-4.2.1
cxf-4.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61466.json"