Apache James implements the SASL OAuthBearer/XOAUTH2 authentication mechanism. A flaw exists where the server does not validate the AUD claim in a JWT payload when introspection is not explicitly configured. If an attacker can supply a JWT that contains valid credentials but an unauthorized AUD value, the server will accept the token and allow email access. This bypasses intended authorization controls, enabling data theft or other malicious activities.

The vulnerability affects the Apache James mail server from the Apache Software Foundation. Versions older than 3.9.1 – including 3.9.1 – are known to lack proper AUD claim validation and introspection enforcement.

Because the flaw permits unauthorized users to misuse valid credentials, the impact is significant. No Public EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the lack of mandatory AUD validation combined with the need for valid credentials indicates that once an attacker has any credential, the barrier to lateral movement within the mail system is removed. The likely attack vector is the SASL authentication channel, where a crafted JWT can be presented by an attacker who has, for example, stolen or guessed credentials.