{
  "@id": "urn:uuid:258978d3-b172-46d2-b762-d7411ed169be",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T08:45:40.986217+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T14:07:28.995205+00:00",
      "status_notes": "Vulnerability CVE-2026-50623 does not affect version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2. not_affected \u2014 Apache CXF version 3.0.12 is not affected by CVE-2026-50623. The vulnerable TokenIntrospectionService class and the /services/oauth2/introspect endpoint do not exist in this version. The token introspection feature (RFC 7662) was introduced in a later version via commit 0578e16146 (January 2016), which is not an ancestor of the 3.0.12 codebase. While a similar AccessTokenValidatorService exists...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50623"
      },
      "impact_statement": "not_affected \u2014 Apache CXF version 3.0.12 is not affected by CVE-2026-50623. The vulnerable TokenIntrospectionService class and the /services/oauth2/introspect endpoint do not exist in this version. The token introspection feature (RFC 7662) was introduced in a later version via commit 0578e16146 (January 2016), which is not an ancestor of the 3.0.12 codebase. While a similar AccessTokenValidatorService exists..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T14:07:28.995205+00:00",
      "status_notes": "Vulnerability CVE-2026-50627 affects version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2.",
      "vulnerability": {
        "name": "CVE-2026-50627"
      },
      "action_statement": "Vulnerability CVE-2026-50627 affects version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-14T08:45:40.986217+00:00",
      "status_notes": "Vulnerability CVE-2026-50628 affects version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2, and is fixed in 3.0.12-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-50628"
      },
      "action_statement": "Vulnerability CVE-2026-50628 affects version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2, and is fixed in 3.0.12-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T14:07:28.995205+00:00",
      "status_notes": "Vulnerability CVE-2026-50629 does not affect version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2. not_affected \u2014 Target version 3.0.12 does not contain the vulnerable code pattern described in CVE-2026-50629. The CVE describes clientId parameter injection into OAuth2 server log warning messages, but version 3.0.12's AbstractTokenService.java has no Logger import and no LOG statements. The vulnerable logging code was introduced in later versions (4.x series). While the target processes clientId from HTTP r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50629"
      },
      "impact_statement": "not_affected \u2014 Target version 3.0.12 does not contain the vulnerable code pattern described in CVE-2026-50629. The CVE describes clientId parameter injection into OAuth2 server log warning messages, but version 3.0.12's AbstractTokenService.java has no Logger import and no LOG statements. The vulnerable logging code was introduced in later versions (4.x series). While the target processes clientId from HTTP r..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T14:07:28.995205+00:00",
      "status_notes": "Vulnerability CVE-2026-50630 affects version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2.",
      "vulnerability": {
        "name": "CVE-2026-50630"
      },
      "action_statement": "Vulnerability CVE-2026-50630 affects version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T14:07:28.995205+00:00",
      "status_notes": "Vulnerability CVE-2026-50631 affects version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2.",
      "vulnerability": {
        "name": "CVE-2026-50631"
      },
      "action_statement": "Vulnerability CVE-2026-50631 affects version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T14:07:28.995205+00:00",
      "status_notes": "Vulnerability CVE-2026-57818 affects version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2.",
      "vulnerability": {
        "name": "CVE-2026-57818"
      },
      "action_statement": "Vulnerability CVE-2026-57818 affects version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T14:07:28.995205+00:00",
      "status_notes": "Vulnerability CVE-2026-61466 does not affect version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2. not_affected \u2014 Apache CXF version 3.0.12 is NOT AFFECTED by CVE-2026-61466. The vulnerability exists in the OAuth2 Dynamic Client Registration endpoint (DynamicRegistrationService class) which does not exist in this version. The DynamicRegistrationService class and its @Path(\"register\") HTTP endpoint were introduced in a later version (between 3.0.12 and 3.6.12). In version 3.0.12, clients are registered prog...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-61466"
      },
      "impact_statement": "not_affected \u2014 Apache CXF version 3.0.12 is NOT AFFECTED by CVE-2026-61466. The vulnerability exists in the OAuth2 Dynamic Client Registration endpoint (DynamicRegistrationService class) which does not exist in this version. The DynamicRegistrationService class and its @Path(\"register\") HTTP endpoint were introduced in a later version (between 3.0.12 and 3.6.12). In version 3.0.12, clients are registered prog..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T08:56:33.379769+00:00",
      "status_notes": "Vulnerability CVE-2026-63687 affects version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2, and is fixed in 3.0.12-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-63687"
      },
      "action_statement": "Vulnerability CVE-2026-63687 affects version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2, and is fixed in 3.0.12-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T14:08:00.086285+00:00",
      "status_notes": "Vulnerability CVE-2026-68079 is fixed in version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2.",
      "vulnerability": {
        "name": "CVE-2026-68079"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.0.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T14:07:28.995205+00:00",
      "status_notes": "Vulnerability CVE-2026-68481 affects version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2.",
      "vulnerability": {
        "name": "CVE-2026-68481"
      },
      "action_statement": "Vulnerability CVE-2026-68481 affects version 3.0.12-tuxcare.3 of org.apache.cxf:cxf-rt-rs-security-oauth2."
    }
  ]
}