CVE-2026-73179

A flaw was found in Apache CXF. The OAuth2 authorization service fails to properly enforce single-use authorization code restrictions due to a race condition during database operations. A remote attacker can exploit this flaw by submitting concurrent token exchange requests, allowing them to obta...