CVE-2026-50631 Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or...

PT-2026-48850

Name of the Vulnerable Software and Affected Versions AbstractOAuthDataProvider versions prior to 4.2.2 AbstractOAuthDataProvider versions prior to 4.1.7 Description A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantic...