The JwtAccessTokenValidator in Apache CXF fails to validate the 'aud' claim of incoming JWTs, allowing a token issued for one resource server to be replayed against another. This token confusion can grant an attacker access to resources they are not authorized to use, compromising confidentiality and integrity on the victim server. The weakness is a flaw in authentication, identified as CWE‑289.

Apache CXF versions prior to 4.1.7 and 4.2.2 are affected. Users should ensure they are running at least 4.1.7 for the 4.1 series or 4.2.2 for the 4.2 series, which contain the fix.

The vulnerability is exploitable over the network, requiring only a valid but misissued JWT to be sent in a request. The absence of an EPSS score and lack of KEV listing suggest it has not yet been widely exploited, but the impact is high if used. The CVSS score is not disclosed in the data, but the nature of the flaw indicates a high severity. Attackers can remotely use the flaw to bypass authorization without additional credentials.