← CVE Intelligence

CVE-2026-57818

Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider PUBLISHED

Description (CNA)

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.

Affected (CNA)

Vendor / productVersions
Apache Software Foundation / Apache CXFaffected 4.2.0 before 4.2.3; affected 4.0.0 before 4.1.8; affected 0 before 3.6.12

CWE

CWE-367

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.