Skip to main content

Apache CXF CVE-2026-68079

| EUVDEUVD-2026-53858 CRITICAL
Authentication Bypass by Capture-replay (CWE-294)
2026-08-06 apache GHSA-7mxw-qv85-693m
Apache Information Disclosure Apache Cxf Red Hat
9.8
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
9.8 LOW
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.9 MEDIUM

Network vector, high complexity due to prerequisite code capture; user interaction required to generate the code; no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch available
Aug 06, 2026 - 13:02 EUVD
Analysis Generated
Aug 06, 2026 - 12:21 vuln.today

DescriptionCVE.org

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

AnalysisAI

Apache CXF's DefaultEncryptingCodeDataProvider allows captured OAuth 2.0 authorization codes to be redeemed an unlimited number of times, violating RFC 6749's single-use requirement. The removeCodeGrant() method that should invalidate a code after first exchange fails to do so, meaning any attacker who intercepts or obtains a legitimate authorization code can replay it repeatedly to obtain additional access tokens. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target Apache CXF instance is deployed as an OAuth 2.0 authorization server using the DefaultEncryptingCodeDataProvider class specifically. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment No CVSS score or vector was provided in the source data, so risk must be inferred from the description and CWE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade Apache CXF to version 4.2.3, 4.1.8, or 3.6.12 depending on the branch in use - these are the vendor-confirmed fixed releases per the Apache advisory at https://lists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Apache Cxf

View all
CVE-2026-44930 CRITICAL
9.8 May 22

Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
CVE-2026-66909 CRITICAL
9.8 Aug 06

Unsafe deserialization in Apache CXF's JMS transport allows any party able to publish to the service's JMS destination t
CVE-2026-44417 HIGH
7.5 May 22

Remote code execution in Apache CXF (versions before 3.6.11, 4.0.0-4.1.5, and 4.2.0) arises because the fix for CVE-2025
CVE-2026-65432 HIGH
7.5 Aug 06

XML External Entity injection in Apache CXF's WSDL import processing allows attackers who can influence imported WSDL or
CVE-2026-64958 HIGH
7.5 Aug 06

Denial of service persists in Apache CXF due to an incomplete remediation of CVE-2026-50645, allowing unauthenticated ne
CVE-2026-61466 CRITICAL
9.1 Aug 06

Authorization scope escalation in Apache CXF's OAuth2 Dynamic Client Registration endpoint allows any registering client
CVE-2026-44618 MEDIUM
5.3 May 22

XML External Entity injection in Apache CXF's WS-Transfer module exposes SOAP endpoints to server-side file read and int
CVE-2026-57818 HIGH
8.1 Aug 06

Double-spending of OAuth2 authorization codes in Apache CXF's JCacheCodeDataProvider enables issuance of multiple valid

CVE-2026-63687 CRITICAL
9.1 Aug 06

Apache CXF's JwtRequestCodeFilter blindly copies all claims from a validly-signed JWT request object into the OAuth2 aut
CVE-2026-65583 CRITICAL
9.1 Aug 06

Authentication bypass in Apache CXF's OIDC relying-party implementation allows network-accessible attackers to forge sel
CVE-2026-68481 HIGH
7.5 Aug 06

Token revocation bypass in Apache CXF's DefaultEncryptingOAuthDataProvider allows revoked OAuth access and refresh token
CVE-2026-57817 HIGH
8.1 Aug 06

Authorization Code Substitution in Apache CXF's OpenID Connect Relying Party implementation allows remote attackers to h

Same weakness CWE-294 – Authentication Bypass by Capture-replay

View all
CVE-2017-3191 CRITICAL
9.8
CVE-2017-6823 HIGH POC
8.8
CVE-2023-1886 CRITICAL POC
9.8
CVE-2023-1537 CRITICAL POC
9.8
CVE-2022-29334 CRITICAL POC
9.8
CVE-2021-27289 CRITICAL POC
9.1
CVE-2022-31277 HIGH POC
8.8
CVE-2022-31265 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

Share

CVE-2026-68079 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy