Posted by Benoit Tellier on Nov 06 Severity: moderate Affected versions: - Apache James 3.9.0 before 3.9.1 Description: Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured. This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so. We recommend users to upgrade to non vulnerable version that forces explicit configuration...
CVE-2025-66621: Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/547
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Re: "sshole": password authentication bypass: OpenSSH + musl libc
Posted by Vincent Lefevre on Nov 05 Perhaps, but in any case, it is up to the application to check error conditions, in particular that the result contains only valid…
Re: "sshole": password authentication bypass: OpenSSH + musl libc
Posted by Loganaden Velvindron on Nov 05 It's unfortunate that some people are writing misleading statements about a security problem in OpenSSH, especially on linkedin…
CVE-2026-74846: Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier
Posted by Robert Rothenberg on Nov 03 CVE-2026-74846 CPAN Security Group CVE ID: CVE-2026-74846 Distribution: Catalyst-Plugin-Authentication Versions: before 0.10029…
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a…
CVE-2026-123770: Apache Axis2/Java: Unbounded multipart and form-encoded request bodies
Posted by Robert Lazarski on Nov 06 Severity: low Affected versions: - Apache Axis2/Java before 2.0.2 Description: Allocation of Resources Without Limits or Throttling…
CVE-2026-123766: Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page
Posted by Robert Lazarski on Nov 06 Severity: moderate Affected versions: - Apache Axis2/Java 2.0.1 before 2.0.2 Description: Improper Neutralization of Input During Web…