Apache CXF CVE-2026-57818

Exploitation requires that the Apache CXF instance be configured as an OAuth2 authorization server using JCacheCodeDataProvider as the authorization code store - deployments using alternative code providers (e.g., database-backed providers) are not affected. The attacker must possess a valid, unredeemed authorization code for the target deployment, obtained through the normal OAuth2 flow, phishing of a redirect URI, CSRF manipulation, or code interception. Exploitation further requires the ability to issue multiple concurrent HTTP requests to the token endpoint within the narrow window between code validation and invalidation. There is no requirement for prior authentication to the CXF service beyond code possession. The race window is bounded by network latency and JCache operation time, making exploitation harder over high-latency connections but feasible on co-located or low-latency attackers.

No NVD CVSS score has been assigned at time of analysis; the following assessment is independently derived. The vulnerability is network-exploitable but carries High attack complexity due to the inherent timing requirement of a race condition - the attacker must submit multiple concurrent token-exchange requests within a very narrow window. The attacker must already possess a valid authorization code, introducing a prerequisite that limits opportunistic exploitation. EPSS data is unavailable; KEV status is negative and no POC has been published. The practical impact is confidentiality-focused: unauthorized issuance of access tokens means an attacker can impersonate the code holder's session or accumulate tokens for extended unauthorized access. For environments using Apache CXF as an OAuth2 authorization server, this is a meaningful risk because the authorization code grant is the most common OAuth2 flow. However, the race-window constraint and the prerequisite of code possession make mass exploitation unlikely - real-world risk is elevated for targeted attacks where an adversary has already obtained a code via phishing, CSRF, or redirect manipulation.

An attacker who has legitimately obtained or intercepted a valid OAuth2 authorization code sends a high volume of simultaneous token-exchange POST requests to the CXF token endpoint before the first request completes its invalidation of the code. Because JCache reads and deletes are non-atomic, multiple requests pass the validity check concurrently and each receives a distinct, valid access token. The attacker now holds multiple tokens and can use them across parallel sessions for unauthorized resource access.