EUVD-2026-36399
GHSA-83r6-96m8-r52p
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable OAuth endpoint (AV:N); attacker needs a leaked refresh token and must win a timing race (AC:H); server requires no authentication beyond the stolen token (PR:N); duplicate access tokens enable session theft (C:H/I:H), no availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
7Description PRE-NVD
AnalysisAI
Refresh token replay in Apache CXF's OAuth2 provider lets remote attackers concurrently exchange a single leaked refresh token for multiple valid access tokens, breaking the single-use property defenders rely on. The flaw lives in AbstractOAuthDataProvider and only manifests when deployments set 'recycleRefreshTokens' to false. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) the target deployment to expose Apache CXF's cxf-rt-rs-security-oauth2 authorization-server endpoints, (2) the non-default configuration 'recycleRefreshTokens=false' on the AbstractOAuthDataProvider, and (3) the attacker to already possess a valid, unexpired refresh token belonging to a victim - the bug does not let an attacker forge or guess refresh tokens. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals diverge sharply. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a victim's refresh token (e.g., via a logged proxy, a compromised mobile device backup, or a leaked client log) fires two or more simultaneous POST /token grant_type=refresh_token requests to the CXF authorization endpoint from parallel threads. Because the check-then-issue path is not atomic, multiple requests pass validation before any marks the refresh token consumed, and the attacker walks away with several independently valid access tokens that can be used in parallel or distributed to collaborators. … |
| Remediation | Vendor-released patch: upgrade to Apache CXF 4.2.2 (for the 4.2.x line) or 4.1.7 (for the 4.1.x line), per the project advisory at https://cxf.apache.org/ and the oss-security thread https://seclists.org/oss-sec/2026/q2/891. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems using Apache CXF OAuth2 and verify their 'recycleRefreshTokens' configuration settings. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inver
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to tr
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
Remote code execution in Apache CXF versions 4.2.0 through 4.2.1 and all versions prior to 4.1.7 can occur when untruste
Remote code execution in Apache CXF's JCA integration module allows attackers to achieve arbitrary code execution via JN
Share
External POC / Exploit Code
Leaving vuln.today