What is GHSA-rg6c-rqpp-49q4?

GHSA-rg6c-rqpp-49q4 is a security advisory published by GitHub Security Advisories with unknown severity. Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim...

Which CVE IDs does GHSA-rg6c-rqpp-49q4 cover?

GHSA-rg6c-rqpp-49q4 covers the following CVE IDs: CVE-2025-66621. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-rg6c-rqpp-49q4unknown

Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim...

Vendor

GitHub Security Advisories

Published

November 6, 2026

Last Modified

November 6, 2026

🔗 CVE IDs covered (1)

CVE-2025-66621 →

📋 Description

Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.

This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.

We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-66621
https://lists.apache.org/thread.html/xz1g0blzcbxod69oktyq84h7t06xzov6
http://www.openwall.com/lists/oss-security/2026/11/06/13
https://github.com/advisories/GHSA-rg6c-rqpp-49q4