CVE-2025-66621: vulnerability in Apache James
Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.1%
Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.
This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.
We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.
Affected products
Apache Software Foundation · Apache JamesRelated CVEs — Apache James
In the same product, most dangerous first.
CVE-2021-40525—Sieve file storage vulnerable to path traversal attacksEPSS 3.8%CVE-2021-40110—Apache James IMAP vulnerable to a ReDoSEPSS 3.0%CVE-2021-38542—Apache James vulnerable to STARTTLS command injection (IMAP and POP3)EPSS 2.3%CVE-2021-40111—Apache James IMAP parsing Denial Of ServiceEPSS 2.2%CVE-2022-28220—STARTTLS command injection in Apache JAMESEPSS 2.0%CVE-2022-22931—Path traversal in Apache James 3.6.1EPSS 1.8%