---
id: CVE-2025-66621
title: >-
  Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if
  misconfigred
summary: >-
  Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate
  correctly AUD claim of JWT payloads when introspection is not configured.


  This allows an attacker with valid credentials to access the mail server even
  if they…
severity: none
cwe:
  - CWE-345
vendor: Apache Software Foundation
product: Apache James
affected:
  - apache_james >= 3.9.0 < 3.9.1
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T11:38:46.849Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-66621'
references:
  - url: 'https://lists.apache.org/thread.html/xz1g0blzcbxod69oktyq84h7t06xzov6'
tags:
  - cve.org
ingestedAt: '2026-11-06T11:50:33.387Z'
---

## Overview

Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.

This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.

We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.

## Affected

- `apache_james >= 3.9.0 < 3.9.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.