CLEANSTART-2026-VE39696 Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from...

Security vulnerability affects the wildfly package. Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent toke...

CVE-2026-73179

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic...

CVE-2026-73179

The Apache CXF JPA OAuth2 authorization code grant provider is vulnerable to a race condition due to non-atomic find-then-delete operations on a shared relational database under READ_COMMITTED isolation. A remote attacker can exploit this to obtain multiple valid access tokens from a single autho...

CVE-2026-73179 Apache CXF: JPA authorization-code consume is non-atomic

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic...

EUVD-2026-95695

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic...

PT-2026-108815

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider allows a...

CVE-2026-73179: Time-of-check Time-of-use (TOCTOU) Race Condition

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic...