Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-57818

Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache CXF

Default version status: unaffected

  • 4.2.0 to < 4.2.3affected
  • 4.0.0 to < 4.1.8affected
  • 0 to < 3.6.12affected

References