The vulnerability arises from an inoperative max_age authentication‑freshness check in OidcClientCodeRequestFilter. A mismatched unit between milliseconds and seconds and an inverted comparison polarity caused the check to always succeed. As a result, any relying party that configured setMaxAgeOffset to force re‑authentication would silently accept sessions regardless of age, allowing users to bypass step‑up authentication policies. This flaw undermines the integrity of authentication sessions, enabling attackers to gain prolonged access without triggering the intended re‑authentication, effectively bypassing a key security boundary. The vulnerability can be exploited in any application that relies on Apache CXF for OIDC integration. An attacker who can influence the OIDC flow could maintain access to a user’s session beyond the expected freshness period, potentially enabling further unauthorized actions.

Apache CXF, versions prior to the following fixes: 4.2.4, 4.1.9, and 3.6.13. All earlier releases lacking these updates are affected. The issue exists in the OidcClientCodeRequestFilter component used by customers to enforce authentication freshness.

The CVSS score is not publicly available, but the nature of the flaw—the ability to permanently bypass forced re‑authentication—indicates a high impact on confidentiality and integrity. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is application‑level, utilizing the OIDC flow in a relying party to maintain an authenticated session beyond its intended lifetime. Attackers do not need special privileges beyond exploiting the usual OIDC integration path, making exploitation feasible for a wide range of threat actors.