CVE-2016-4464: Apache CXF Fediz SAML AudienceRestriction Bypass
Summary
CVE-2016-4464: The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass inten... Affects org.apache.cxf.fediz:fediz-spring across 2 version ranges.
>= 1.2.0, < 1.2.3
>= 1.3.0, < 1.3.1
Fixed in 1.2.3 or 1.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF Fediz is an open-source library that provides support for the WS-Federation Passive Requestor Profile. It enables web applications to integrate with identity providers using the WS-Federation protocol. The 'org.apache.cxf.fediz:fediz-spring' and 'org.apache.cxf.fediz:fediz-spring2' packages are part of Apache CXF Fediz and are used for integrating Fediz with Spring applications.
Vulnerability Detail
The application plugins in Apache CXF Fediz versions 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not properly match SAML AudienceRestriction values against configured audience URIs. This vulnerability allows remote attackers to bypass intended restrictions and potentially have other unspecified impacts by crafting a SAML token with a trusted signature.
How To Fix
Latest published version: 1.7.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.2.0, < 1.2.31.2.3 -
>= 1.3.0, < 1.3.11.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to the fixed versions of Apache CXF Fediz.
Conclusion
The vulnerability in Apache CXF Fediz allows remote attackers to bypass intended restrictions and potentially have other impacts by exploiting a flaw in SAML AudienceRestriction matching. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of Apache CXF Fediz. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.apache.cxf.fediz:fediz-spring →
FAQ
Apache CXF Fediz is an open-source library that enables web applications to integrate with identity providers using the WS-Federation protocol.
This vulnerability allows remote attackers to bypass intended restrictions and potentially have other unspecified impacts by crafting a SAML token with a trusted signature.
To fix this vulnerability, it is recommended to upgrade to Apache CXF Fediz version 1.2.3 or 1.3.1, depending on the package being used. Developers should update their Maven dependencies to include the fixed versions.
There is no known workaround for this vulnerability. It is necessary to upgrade to the fixed versions of Apache CXF Fediz.
For more information about this vulnerability, you can refer to the CVE-2016-4464 entry or the GitHub advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf.fediz:fediz-spring.
