WhatBrokeToday
Today's Trends
criticalInvestigatingApachev3.9.1

Apache James 3.9.1 SASL OAuthBearer/XOAUTH2 Vulnerability

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

Apache James version 3.9.1 is affected by a critical vulnerability (CVE-2025-66621) where the SASL OAuthBearer/XOAUTH2 module fails to validate AUD claim of JWT payloads, allowing unauthorized access if introspection is not configured. Users are recommended to upgrade to non-vulnerable versions that enforce explicit configuration of aud claims and introspection.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

Apache James version 3.9.1 does not properly validate the AUD claim in JWT payloads for OAuthBearer/XOAUTH2 authentication, leading to potential unauthorized access.

Evidence

1 report · 1 CVEShow
  1. [1]
    CVE First report
    Apache James SASL OAuthBearer/XOAUTH2: CVE-2025-66621 (Critical)(opens security advisory in a new tab)

    Critical severity. Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured. This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so. We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.

    by Tenable 0upvotes 0comments

Timeline

  1. First report on security advisory

    Apache James SASL OAuthBearer/XOAUTH2: CVE-2025-66621 (Critical)

    Source