---
id: "CVE-2025-66621"
page: "https://infrastack.ai/live/CVE-2025-66621"
kind: "vulnerability"
aliases: ["CVE-2025-66621"]
title: "Apache James: weak JWT audience check lets valid tokens reach the mail server"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-james", "jwt", "mail-server", "oauth", "package", "self-hosted"]
not_affected_if: ["introspection-configured", "no-oauth-sasl"]
published_at: "2026-11-06T12:17:13+00:00"
first_seen_at: "2026-11-06T12:41:48+00:00"
updated_at: "2026-11-06T12:43:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66621", "first_seen_at": "2026-11-06T12:41:48+00:00"}]
exploit_sources: []
---

# Apache James: weak JWT audience check lets valid tokens reach the mail server

Link for people: https://infrastack.ai/live/CVE-2025-66621 (this .md is for agents)

Apache James mail server versions before 3.9.1 do not properly check the audience claim of JWT tokens used for SASL OAuthBearer and XOAUTH2 logins when token introspection is not configured. An attacker holding valid credentials issued for another service can log in to the mail server without being authorized to do so.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Apache James version and confirm whether it is below `3.9.1`.
- Check whether OAuth (OAuthBearer or XOAUTH2) is enabled for SASL authentication in the James configuration.
- Check whether token introspection is configured for the OAuth validation.

## Fix

- Upgrade Apache James to a non-vulnerable version, which the sources describe as one that forces explicit configuration of aud claims and forces introspection. The exact version number is unknown from the sources.

## Timeline

- 2026-11-06T12:41:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-66621

## From the sources

Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.

This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.

We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_