Apache CXF OAuth2 Scope Injection Lets Clients Claim Admin Privileges

Executive Summary

The Apache Software Foundation has disclosed CVE-2026-61466, a critical authorization bypass in Apache CXF's OAuth2 Dynamic Client Registration implementation. The authorization server accepts and stores the scope field from a client registration request verbatim without validating it against a server-defined allowlist — enabling any registering client to self-assign privileged or administrative scopes it was never intended to receive.

CVSS Score: 9.1 (Critical)

This vulnerability was disclosed on August 6, 2026 alongside a cluster of Apache CXF security advisories. It requires no existing credentials beyond the ability to reach the client registration endpoint, which is frequently public-facing by design in OAuth2 deployments.

Vulnerability Overview

Root Cause

The OAuth2 Dynamic Client Registration endpoint (as defined in RFC 7591) allows clients to self-register by submitting a registration request including a desired scope. RFC 7591 specifies that the authorization server may grant a subset of requested scopes and should enforce its own policy. Apache CXF failed to enforce this — it stored whatever scope string the registering client provided.

CWE-20: Improper Input Validation

Attack Chain

1. Attacker discovers target uses Apache CXF OAuth2 Dynamic Client Registration
2. Submits a POST /oauth2/register request with an inflated scope:
   { "client_name": "myapp", "scope": "read write admin:all delete:*" }
3. CXF stores the scope verbatim in the authorization server database
4. Attacker uses the registered client credentials to obtain an access token
5. Access token carries admin-level scopes — bypasses all intended permission checks
6. Attacker accesses protected APIs far beyond the intended permission boundary

Impact

Both confidentiality and integrity are compromised:

• Unauthorized access to sensitive data protected by privileged scopes
• Ability to perform administrative operations on behalf of unprivileged clients
• No authentication required — only network access to the registration endpoint

Technical Details

Affected Versions

What Dynamic Client Registration Is

OAuth2 Dynamic Client Registration (RFC 7591) allows programmatic registration of OAuth2 clients without manual admin intervention. It's common in microservice architectures and developer platforms where clients need to self-onboard. When the registration endpoint is publicly accessible — as designed — the scope injection attack is trivially exploitable.

Scope Injection Payload Example

POST /oauth2/register HTTP/1.1
Content-Type: application/json
 
{
  "client_name": "innocent-app",
  "redirect_uris": ["https://attacker.example/callback"],
  "scope": "openid profile email admin:read admin:write delete:users"
}

In a patched server, the response would trim the scope to only openid profile email. In a vulnerable server, the response echoes back — and stores — the full attacker-supplied scope string.

Detection

Identify Vulnerable Deployments

# Check your CXF version
mvn dependency:tree | grep cxf-rt-rs-security-oauth
 
# Look for Dynamic Client Registration endpoint configuration
grep -r "DynamicRegistration\|oauth2/register\|OAuthDataProvider" \
  src/ config/ --include="*.xml" --include="*.java"

Audit Registered OAuth2 Clients for Injected Scopes

If you run Apache CXF OAuth2, audit your registered clients immediately:

-- Query the OAuth2 client store for over-privileged scopes
-- (adjust table/column names to your CXF OAuth2 data provider)
SELECT client_id, client_name, allowed_scopes
FROM oauth_clients
WHERE allowed_scopes LIKE '%admin%'
   OR allowed_scopes LIKE '%delete%'
   OR allowed_scopes LIKE '%:all%'
ORDER BY registration_date DESC;

Treat any client with administrative scopes that you did not manually assign as potentially injected.

Immediate Remediation

Option 1: Upgrade Apache CXF (Recommended)

Update to a patched release:

<!-- Maven pom.xml -->
<dependency>
    <groupId>org.apache.cxf</groupId>
    <artifactId>cxf-rt-rs-security-oauth2</artifactId>
    <version>4.2.3</version><!-- or 4.1.8 or 3.6.12 -->
</dependency>

After patching, audit existing registered clients for scopes that may have been injected before the upgrade and revoke or reissue credentials for any suspicious registrations.

Option 2: Restrict the Registration Endpoint

If you cannot patch immediately, require authentication to access the Dynamic Client Registration endpoint:

<!-- CXF JAX-RS security configuration -->
<jaxrs:server address="/oauth2">
    <jaxrs:serviceBeans>
        <ref bean="dynamicRegistrationService"/>
    </jaxrs:serviceBeans>
    <jaxrs:providers>
        <!-- Require bearer token or basic auth to register -->
        <ref bean="authenticationFilter"/>
    </jaxrs:providers>
</jaxrs:server>

Option 3: Implement a Server-Side Scope Allowlist

Override the default OAuthDataProvider to explicitly validate and trim requested scopes:

@Override
public Client createNewClient(ClientRegistration reg) {
    Set<String> allowedScopes = Set.of("read", "write", "profile", "openid");
    List<String> requested = Arrays.asList(reg.getRequestedScope().split(" "));
    List<String> granted = requested.stream()
        .filter(allowedScopes::contains)
        .collect(Collectors.toList());
    reg.setApprovedScope(String.join(" ", granted));
    return super.createNewClient(reg);
}

Post-Patch Actions

1. Revoke all client tokens registered before the patch date and force re-registration
2. Audit access logs for API calls using admin-scoped tokens from unexpected clients
3. Enable scope logging — log the granted scope on every token issuance
4. Restrict registration — consider requiring admin approval for scope requests beyond a safe baseline

Related CVEs in This Advisory Batch

References

• Apache CXF Security Advisories
• NVD — CVE-2026-61466
• RFC 7591 — OAuth 2.0 Dynamic Client Registration Protocol
• CWE-20: Improper Input Validation

Related Reading

• Apache CXF JMS Deserialization RCE — CVE-2026-66909
• Apache Struts Critical RCE via OGNL Injection Returns