CVE-2021-22696

CVE-2021-22696 describes a denial-of-service vulnerability in Apache CXF versions prior to 3.4.3 and 3.3.10. The vulnerability arises from CXF's failure to properly validate the "request_uri" parameter when retrieving JWT tokens, allowing an attacker to trigger REST requests to arbitrary URIs. With a CVSS score of 7.5 (High), this flaw could lead to a denial-of-service against the authorization server, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.