{"id":"CVE-2025-66621","kind":"vulnerability","aliases":["CVE-2025-66621"],"related":[],"title":"Apache James: weak JWT audience check lets valid tokens reach the mail server","description":"Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.\n\nThis allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.\n\nWe recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.","summary":"Apache James mail server versions before 3.9.1 do not properly check the audience claim of JWT tokens used for SASL OAuthBearer and XOAUTH2 logins when token introspection is not configured. An attacker holding valid credentials issued for another service can log in to the mail server without being authorized to do so.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-james","jwt","mail-server","oauth","package","self-hosted"],"not_affected_if":["introspection-configured","no-oauth-sasl"],"how_to_check":"- Check the installed Apache James version and confirm whether it is below `3.9.1`.\n- Check whether OAuth (OAuthBearer or XOAUTH2) is enabled for SASL authentication in the James configuration.\n- Check whether token introspection is configured for the OAuth validation.","fix":"- Upgrade Apache James to a non-vulnerable version, which the sources describe as one that forces explicit configuration of aud claims and forces introspection. The exact version number is unknown from the sources.","status":"open","published_at":"2026-11-06T12:17:13+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","triaged_at":"2026-11-06T12:43:01+00:00","updated_at":"2026-11-06T12:43:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T12:43:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache James to a non-vulnerable version, which the sources describe as one that forces explicit configuration of aud claims and forces introspection. The exact version number is unknown from the sources.","reach":"network","title":"Apache James: weak JWT audience check lets valid tokens reach the mail server","impact":"medium","summary":"Apache James mail server versions before 3.9.1 do not properly check the audience claim of JWT tokens used for SASL OAuthBearer and XOAUTH2 logins when token introspection is not configured. An attacker holding valid credentials issued for another service can log in to the mail server without being authorized to do so.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-james","mail-server","self-hosted","oauth","jwt"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker with another service's valid token reads or sends mail","analyst_note":"Sources give no exact fixed version or severity; check the NVD entry and the Apache James security advisory for the fixed version number.","how_to_check":"- Check the installed Apache James version and confirm whether it is below `3.9.1`.\n- Check whether OAuth (OAuthBearer or XOAUTH2) is enabled for SASL authentication in the James configuration.\n- Check whether token introspection is configured for the OAuth validation.","plain_action":"","needs_analyst":true,"not_affected_if":["no-oauth-sasl","introspection-configured"],"who_is_affected":"Teams running Apache James with SASL OAuthBearer or XOAUTH2 authentication backed by JWT tokens and no token introspection configured. The flaw lets a holder of valid credentials for another audience access the mail server. Installations that do not use OAuth for SASL, or that already configure introspection, are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000762,"input_tokens":4270,"output_tokens":671,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':15A,18A '-66621':16A,19A '3.9.1':38B,87C 'access':110C 'allow':103C 'anoth':69B 'apach':1A,21B,32B,81C 'apache-jam':20B 'attack':63B,105C 'aud':92C,137C 'audienc':5A,44B 'author':80B,119C 'check':6A,42B 'claim':45B,93C,138C 'configur':61B,101C,135C 'correct':91C 'credenti':66B,108C 'cve':14A,17A 'even':114C 'explicit':134C 'fail':88C 'forc':133C,140C 'hold':64B 'host':31B 'introspect':58B,98C,141C 'issu':67B 'jame':2A,22B,33B,82C 'jwt':4A,23B,47B,95C 'let':7A 'log':72B 'login':55B 'mail':12A,25B,34B,76B,112C 'mail-serv':24B 'non':129C 'oauth':27B 'oauthbear':52B 'oauthbearer/xoauth2':84C 'packag':28B 'payload':96C 'prior':85C 'proper':41B 'reach':10A 'recommend':124C 'sasl':51B,83C 'self':30B 'self-host':29B 'server':13A,26B,35B,77B,113C 'servic':70B 'token':9A,48B,57B 'upgrad':127C 'use':49B 'user':125C 'valid':8A,65B,90C,107C 'version':36B,86C,131C 'vulner':130C 'weak':3A 'without':78B 'xoauth2':54B","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache James with SASL OAuthBearer or XOAUTH2 authentication backed by JWT tokens and no token introspection configured. The flaw lets a holder of valid credentials for another audience access the mail server. Installations that do not use OAuth for SASL, or that already configure introspection, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachejames","jwt","mailserver","oauth","package","selfhosted","unknown"],"campaign_type":null,"search_a":"'-2025':15A,18A '-66621':16A,19A 'apach':1A 'audienc':5A 'check':6A 'cve':14A,17A 'jame':2A 'jwt':4A 'let':7A 'mail':12A 'reach':10A 'server':13A 'token':9A 'valid':8A 'weak':3A","search_b":"'3.9.1':38B 'anoth':69B 'apach':21B,32B 'apache-jam':20B 'attack':63B 'audienc':44B 'author':80B 'check':42B 'claim':45B 'configur':61B 'credenti':66B 'hold':64B 'host':31B 'introspect':58B 'issu':67B 'jame':22B,33B 'jwt':23B,47B 'log':72B 'login':55B 'mail':25B,34B,76B 'mail-serv':24B 'oauth':27B 'oauthbear':52B 'packag':28B 'proper':41B 'sasl':51B 'self':30B 'self-host':29B 'server':26B,35B,77B 'servic':70B 'token':48B,57B 'use':49B 'valid':65B 'version':36B 'without':78B 'xoauth2':54B","search_c":"'3.9.1':87C 'access':110C 'allow':103C 'apach':81C 'attack':105C 'aud':92C,137C 'author':119C 'claim':93C,138C 'configur':101C,135C 'correct':91C 'credenti':108C 'even':114C 'explicit':134C 'fail':88C 'forc':133C,140C 'introspect':98C,141C 'jame':82C 'jwt':95C 'mail':112C 'non':129C 'oauthbearer/xoauth2':84C 'payload':96C 'prior':85C 'recommend':124C 'sasl':83C 'server':113C 'upgrad':127C 'user':125C 'valid':90C,107C 'version':86C,131C 'vulner':130C","first_public_at":"2026-11-06T12:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-66621","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66621","severity":null,"published_at":"2026-11-06T12:17:13+00:00","modified_at":"2026-11-06T12:17:13+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","fetched_at":"2026-11-06T12:41:48+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}