Apache CXF’s OIDC relying‑party token validator allows self‑issued ID tokens to bypass required claim checks for issuer, subject, audience, time, and sub_jwk binding. This flaw means an attacker can craft a token that appears legitimate and gain authenticated access to the system without using a real identity. The weakness is classified as CWE‑345, a violation of the Authentication Expectation principle.

The vulnerability affects Apache CXF releases prior to 4.2.3, 4.1.8, or 3.6.12. Any deployment using an older Apache CXF version that participates in OIDC authentication is potentially exposed unless it disables self‑issued token support.

The EPSS score is not available and the CVE is not listed in the CISA KEV catalog, but the nature of the flaw—an authentication bypass—raises high concern. An attacker who can issue or obtain a crafted ID token can impersonate any user and access protected resources. Based on the description, the likely attack vector is remote, requiring the ability to submit a token to the relying party; no special privileges or local access are necessary. Because the flaw centers on token validation, it represents a significant threat to confidentiality and integrity of authenticated sessions. The CVSS score of 9.1 indicates this flaw is rated as critical severity.