A critical vulnerability in Apache CXF allows attackers to perform Authorization Code Injection due to improper input validation, necessitating an immediate update.

This is an improper input validation vulnerability (CWE-20) occurring within the OpenID Connect implementation. The vulnerability is exploitable by an unauthenticated remote attacker who can leverage a misconfigured or non-compliant Identity Provider to bypass security controls.

Successful exploitation permits an attacker to substitute or inject authorization codes, leading to complete compromise of the authentication process. With a CVSS score of 9.8, this flaw presents a critical risk to data confidentiality and integrity, as it allows unauthorized access to user sessions and protected resources.

Immediate Action: Upgrade Apache CXF to version 4.2.3, 4.1.8, or 3.6.12 to ensure proper validation of the c_hash parameter.

Proactive Monitoring: Review authentication logs for anomalous token requests or unexpected authorization code usage patterns.

Compensating Controls: Ensure that integrated Identity Providers are strictly configured to include the required c_hash parameter, and utilize a WAF to inspect OpenID Connect traffic for malformed requests.

Public Exploit Available: Unknown

Given the critical CVSS severity and the potential for full system compromise, organizations should prioritize patching their Apache CXF instances immediately. Verify that all integrated Identity Providers strictly adhere to OpenID Connect Core 1.0 specifications to further reduce the attack surface.