The flaw stems from a missing throw statement in the security context check of the OAuth2 TokenIntrospectionService, allowing any unauthenticated caller to invoke the /services/oauth2/introspect endpoint. This results in an authentication bypass (CWE‑287) that can expose token validity and, based on the description, it is inferred that the introspection data may contain sensitive session information.

Apache CXF deployments that expose the OAuth2 TokenIntrospectionService are affected, specifically versions released before 4.2.2 (for CXF 4.x) or 4.1.7 (for CXF 4.1.x). Any configuration that makes the /services/oauth2/introspect endpoint reachable from external networks can be exploited.

Because the endpoint accepts unauthenticated requests from any network location, an attacker can trivially read introspection data without credentials. The low EPSS score of less than 1% and absence of inclusion in the CISA KEV catalog do not reduce the potential impact in environments where token details are protected. The risk, reflected in a CVSS score of 6.5, is moderate‑to‑high where the introspection service is exposed externally.