CVE-2025-66621None▾ SunlitApache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured. This allows an attacker with valid credentials to access the mail server even if they…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.
This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.
We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.
apache_james >= 3.9.0 < 3.9.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-74756NoneApache James: WebAdmin exposed without authentication on official Docker default
CVE-2026-76168NoneApache James: ManageSieve file implementation cross-user path traversal
CVE-2026-85111High· 8.7Apache James: Denial of service upon MIME parsing
CVE-2026-49939NoneApache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
CVE-2026-76171NoneApache James: SSRF filter bypass in the JMAP PushSubscription web-push client
CVE-2026-110985Critical· 9.1Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured