Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2025-66621— Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred

Quick assessment

Affected

Apache Software Foundation Apache James

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 3.9.1 版本之前的 Apache James SASL OAuthBearer/XOAUTH2 中，当未配置令牌内省（introspection）时，系统无法正确验证 JWT 负载中的（受众）声明。此漏洞使得拥有有效凭证的攻击者，即使未被授权，也能访问邮件服务器。我们建议用户升级到非易受影响的版本，该版本会强制要求显式配置声明，并强制启用令牌内省机制。

AI Predicted 7.5 Difficulty: Easy Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Updated Nov 06, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred

Source: CVE Program / CVE List V5

Vulnerability Description

Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured. This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so. We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

对数据真实性的验证不充分

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache James	3.9.0 ~ 3.9.1	-

II. Public POCs for CVE-2025-66621

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2025-66621

请登录查看更多情报信息。

Other References for CVE-2025-66621 (1)

https://lists.apache.org/thread.html/xz1g0blzcbxod69oktyq84h7t06xzov6 vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2025-66621

Same Patch Batch · Apache Software Foundation · 2026-11-06 · 7 CVEs total

CVE-2026-85111	8.7 HIGH	Apache James: Denial of service upon MIME parsing
CVE-2026-49939		Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
CVE-2026-76171		Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client
CVE-2026-74756		Apache James: WebAdmin exposed without authentication on official Docker default
CVE-2026-76168		Apache James: ManageSieve file implementation cross-user path traversal
CVE-2026-85108		Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Th

IV. Related Vulnerabilities

Same product: Apache James

Same vendor: Apache Software Foundation

Same weakness: CWE-345