CVE-2026-57818 Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...

CVE-2026-57818

The vulnerability CVE-2026-57818 affects the JCacheCodeDataProvider used in Apache CXF’s OAuth2 implementation. A TOCTOU race condition allows an attacker to redeem a single authorization code multiple times through concurrent requests, causing issuance of multiple distinct, valid access tokens. ...

CVE-2026-68079

Apache CXF’s DefaultEncryptingCodeDataProvider has a flaw in removeCodeGrant that allows an authorization code to be redeemed unlimited times, violating the one-time-use RFC requirement. This can enable unlimited replay of captured codes. Affected versions are fixed in CXF 4.2.3, 4.1.8, and 3.6.1...