The vulnerability in Apache CXF’s JwtRequestCodeFilter allows a signed request JWT to copy all of its claims into the authorization parameter map without filtering security‑sensitive fields. An attacker who can produce a correctly signed JWT—by possessing or compromising the client secret—can replace the PKCE values (code_challenge, code_challenge_method) as well as nonce and state fields originally supplied in the outer HTTP request. This undermines the integrity checks that protect OAuth 2.0 authorization code exchanges and OpenID Connect replay protection. The flaw is catalogued as CWE‑345.

The issue affects Apache CXF deployments using any version prior to the security releases identified by the Apache Software Foundation. Users are advised to upgrade to Apache CXF 4.2.3, 4.1.8, or 3.6.12, which contain the fix. All earlier releases of Apache CXF that employ the JwtRequestCodeFilter are vulnerable.

The CVSS score for this vulnerability is 9.1, indicating high severity. The attack requires the ability to forge a validly‑signed JWT, which typically implies compromise of the client secret or possession of the signing key. While EPSS data is not available, the CVE has not been listed in CISA’s KEV catalog. The removal of PKCE integrity and replay safeguards can enable credential misuse, data tampering, or session hijack attacks, presenting a high‑severity risk for systems relying on OAuth 2.0 or OpenID Connect flows. Given the potential for privilege escalation in authentication, the vulnerability should be considered high risk.