Apache CXF cached validated security tokens using Java Arrays.hashCode, a non‑cryptographic 32‑bit hash. When an attacker crafts a token that hashes to a value already in the cache, the library treats the cache hit as proof of prior validation, ignoring password verification, signature checking, and even calls to the STS. This permits the attacker to log in as any user and generate STS‑signed tokens for that identity, compromising confidentiality and integrity.

The vulnerability affects the Apache Software Foundation’s Apache CXF product. All versions prior to 4.2.4, 4.1.9, and 3.6.13 are impacted, as those are the releases that contain the fixed implementation of the STS token validator and cache logic.

The CVE lacks an EPSS score and is not listed in the CISA KEV catalog, so publicly reported exploitation data is limited. Nevertheless, the weakness provides a direct authentication bypass that can be triggered remotely by submitting a forged token to any service that relies on CXF’s STS token validation. Given the ability to impersonate users and obtain privileged tokens, the risk level is high for affected installations. The CVSS score of 7.4 indicates a high severity impact.