The vulnerability resides in Apache CXF’s OAuth2 Dynamic Client Registration endpoint, where the authorization server stores the "scope" field supplied by a client without any validation against its own allowlist. This flaw enables a client to request and persist privileged scopes that it would normally be denied, effectively granting it broader permissions than intended. The weakness is captured by CWE‑304, indicating insufficient authorization checks. The impact is a serious privilege escalation for any client that manages or registers with the server, potentially granting unauthorized access to protected resources or administrative functions.

Affected products are those provided by the Apache Software Foundation under the Apache CXF umbrella. Versions before 4.2.3, 4.1.8, or 3.6.12 lack the fix that enforces scope validation. Users should verify the version of Apache CXF in use and apply the corresponding update to eliminate the capability to self‑assign privileged scopes.

The CVSS score is not provided in the data, but the flaw allows an attacker who can register a client to obtain elevated privileges. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploitation. Based on the description, the likely attack vector is a client registration request—typically exposed to any who can reach the endpoint—and the risk is moderate to high, especially in environments where client registration is open to untrusted parties.