CVE-2016-4464: Apache Cxf Fediz

Critical severity, CVSS 9.8. EPSS: 6.5% chance of exploitation in the next 30 days.

The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.

Affected products

• Apache Cxf Fediz: version 1.2.0 only; version 1.2.1 only; version 1.2.2 only; version 1.3.0 only

Published 2016-09-21. Last modified 2026-06-17.