CVE-2025-66621 · Package
NO FIX YET · SEE WHAT TO DO
Apache James mail server versions before 3.9.1 do not properly check the audience claim of JWT tokens used for SASL OAuthBearer and XOAUTH2 logins when token introspection is not configured. An attacker holding valid credentials issued for another service can log in to the mail server without being authorized to do so.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Apache James with SASL OAuthBearer or XOAUTH2 authentication backed by JWT tokens and no token introspection configured. The flaw lets a holder of valid credentials for another audience access the mail server. Installations that do not use OAuth for SASL, or that already configure introspection, are less exposed.
Not affected if introspection-configured, no-oauth-sasl
Who cares apache-james, jwt, mail-server, oauth, self-hosted
3.9.1.Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.
This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.
We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.