The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the c_hash parameter when operating in the Hybrid Flow. Because Apache CXF does not enforce this check, a non‑compliant or misconfigured IdP that omits the c_hash can lead the RP to accept a substituted authorization code. This flaw permits an attacker to replace the legitimate code with one they control, thereby gaining access with the victim's privileges. The weakness is a classic input validation error (CWE‑20) and an improper authentication/authorization flaw (CWE‑303).

The affected product is Apache CXF from the Apache Software Foundation. Versions older than 4.2.3, 4.1.8, and 3.6.12 are vulnerable. The recommendation is to upgrade to any of those fixed releases, or apply supplementary verification of the c_hash if backward compatibility constraints exist.

The CVSS score is 8.1, and the EPSS score is < 1%. The vulnerability is not listed in CISA’s KEV catalog. The risk manifests when an IdP fails to provide the required c_hash, which can happen due to misconfiguration or intentional suppression. An attacker could subvert the authorization process by injecting a malicious code, leading to unauthorized session acquisition. The exploit requires the ability to manipulate the auth flow, likely through a compromised or poorly configured IdP.