CVE-2026-71575

Critical

Description

The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

SeverityCritical

CVSS9.1

Exploit probability—

Product

Apache Cxf

PublishedOct 9, 2026

First seenOct 9, 2026

Weakness typeCWE-613CWE-613

How to fix

Update

apache cxf3.6.13, 4.1.9, 4.2.4 or later

Vendor advisories

lists.apache.org/thread/p1r9t4xl8ny7rg8wmj8nrygx35ds6vcs

Affected products

Product	Affected versions	Fixed in
apache cxf	v < 3.6.13, 4.0.0 ≤ v < 4.1.9, 4.2.0 ≤ v < 4.2.4	3.6.13, 4.1.9, 4.2.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.