CVE-2026-50631

A race condition in the AbstractOAuthDataProvider of Apache CXF allows concurrent requests using the same Refresh Token to bypass single-use semantics. When the recycleRefreshTokens parameter is set to false , an attacker can replay a leaked refresh token concurrently to generate multiple valid A...