Apache CXF’s DefaultEncryptingOAuthDataProvider allows revoked access and refresh tokens to be decrypted and treated as active. The flaw means that an attacker who obtains a revoked token can continue to authenticate services, effectively bypassing the OAuth 2.0 requirement that a revoked token be rejected and return active:false. The bug arises from improper validation of a token’s revocation status, a classic case of logical error in token revocation handling (CWE‑672).

This vulnerability exists in Apache CXF versions older than 4.2.3, 4.1.8, and 3.6.12. Organizations using these older releases are susceptible until they apply the patched versions. The flaw affects all deployments that rely on CXF’s DefaultEncryptingOAuthDataProvider for OAuth token validation.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, but the impact on authentication integrity is high. Based on the description, it is inferred that an attacker can remotely present a revoked token to any client or server that uses the affected CXF library, and the token will be accepted as active, providing unauthorized access. Exploitation requires no special privileges and can be performed by external adversaries who possess or can harvest a revoked token.