Apache CXF: Inoperative max_age check in OIDC relying party filter
Summary
The max_age authentication-freshness check in Apache CXF's OidcClientCodeRequestFilter does not work, due to a milliseconds/seconds unit mismatch and an inverted comparison. Applications that use setMaxAgeOffset to force re-authentication silently accept sessions of any age, so step-up authentication policies can be bypassed. Exploitation requires an application that relies on this check and a stale session or token that should have been rejected.
Affected
- Apache CXF 4.2.0 before 4.2.4 (org.apache.cxf:cxf-rt-rs-security-sso-oidc)
- Apache CXF 4.0.0 before 4.1.9
- Apache CXF before 3.6.13 (default configuration unaffected)
Fixed in
- Apache CXF 4.2.4
- Apache CXF 4.1.9
- Apache CXF 3.6.13
Workaround
Unknown. No vendor workaround is published; upgrading is the fix.
Exploitation
- No exploitation reported in the sources reviewed.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No public proof of concept found; the fix commit is public.
Our recommendation
- Check whether applications or dependency trees include cxf-rt-rs-security-sso-oidc and which version.
- Upgrade to 4.2.4, 4.1.9 or 3.6.13 or later.
- Where max_age is used for step-up login, test after the upgrade that re-authentication is enforced.
- Prioritise internet-facing OIDC login portals.
- No Apache fix is listed for 3.4.x or 3.5.x; treat these branches as unknown status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- oss-security post CVE-2026-71575 www.openwall.com
- Apache mailing list thread lists.apache.org
- Apache CXF security advisories cxf.apache.org
- Fix commit pull request #3357 github.com
- Apache CXF commit message 69101 mail-archive.com
- Apache CXF advisory commit message 70473 mail-archive.com
- HeroDevs vulnerability directory www.herodevs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:07.
Original description (NVD)
The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.