CVE-2026-68079

Apache CXF’s DefaultEncryptingCodeDataProvider has a flaw in removeCodeGrant that allows an authorization code to be redeemed unlimited times, violating the one-time-use RFC requirement. This can enable unlimited replay of captured codes. Affected versions are fixed in CXF 4.2.3, 4.1.8, and 3.6.1...

CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once."...