CVE-2026-68079

A flaw in the DefaultEncryptingCodeDataProvider component of Apache CXF allows a remote attacker to redeem a captured authorization code an unlimited number of times. This is caused by a defect in the removeCodeGrant functionality, which fails to properly invalidate used authorization codes, viol...