CVE-2026-50631

A Time-of-check Time-of-use (TOCTOU) race condition exists in the AbstractOAuthDataProvider component of Apache CXF . When recycleRefreshTokens is set to false , concurrent requests using the same Refresh Token can bypass single-use semantics to generate multiple valid Access Tokens . This allows...