EUVD-2026-36399
GHSA-83r6-96m8-r52p
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable OAuth endpoint (AV:N); attacker needs a leaked refresh token and must win a timing race (AC:H); server requires no authentication beyond the stolen token (PR:N); duplicate access tokens enable session theft (C:H/I:H), no availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
7Description PRE-NVD
AnalysisAI
Refresh token replay in Apache CXF's OAuth2 provider lets remote attackers concurrently exchange a single leaked refresh token for multiple valid access tokens, breaking the single-use property defenders rely on. The flaw lives in AbstractOAuthDataProvider and only manifests when deployments set 'recycleRefreshTokens' to false. No public exploit identified at time of analysis, and EPSS sits at 0.02% (4th percentile), but SSVC scores technical impact as 'total' due to the OAuth trust implications.
Technical ContextAI
Apache CXF is a widely deployed open-source services framework that ships an OAuth 2.0 provider implementation (cxf-rt-rs-security-oauth2). AbstractOAuthDataProvider is the base class responsible for issuing and invalidating tokens. CWE-367 (Time-of-check Time-of-use) applies because the token-refresh code path validates the refresh token and then mints a new access token without an atomic guard, so two concurrent /token requests presenting the same refresh_token can both pass the check before either invalidates it. When recycleRefreshTokens=false the original refresh token is intentionally preserved across rotations, widening the window in which the race is observable and exploitable.
RemediationAI
Vendor-released patch: upgrade to Apache CXF 4.2.2 (for the 4.2.x line) or 4.1.7 (for the 4.1.x line), per the project advisory at https://cxf.apache.org/ and the oss-security thread https://seclists.org/oss-sec/2026/q2/891. As an interim compensating control where upgrade is blocked, set recycleRefreshTokens=true so refresh tokens are rotated on each successful exchange - this closes the observable race window but breaks any client flow that relies on long-lived refresh tokens across rotations and will invalidate cached tokens in mobile/SPA clients on next refresh. Additional mitigations worth pairing: shorten refresh-token TTL on the authorization server to limit replay value, enforce refresh-token binding to client_id/IP where the deployment supports it, and add server-side detection of duplicate refresh_token uses within a short window (typical OAuth refresh-rotation breach-detection pattern) so a successful race triggers immediate revocation of the entire token family.
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attac
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote att
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inver
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to tr
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Conn
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attac
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a cons
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryp
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today