EUVD-2026-53858
GHSA-7mxw-qv85-693m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network vector, high complexity due to prerequisite code capture; user interaction required to generate the code; no availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
AnalysisAI
Apache CXF's DefaultEncryptingCodeDataProvider allows captured OAuth 2.0 authorization codes to be redeemed an unlimited number of times, violating RFC 6749's single-use requirement. The removeCodeGrant() method that should invalidate a code after first exchange fails to do so, meaning any attacker who intercepts or obtains a legitimate authorization code can replay it repeatedly to obtain additional access tokens. No public exploit has been identified at time of analysis, and the issue is addressed in patched releases 4.2.3, 4.1.8, and 3.6.12.
Technical ContextAI
Apache CXF (CPE: cpe:2.3:a:apache_software_foundation:apache_cxf:*:*:*:*:*:*:*:*) is a widely used open-source Java framework for building SOAP and RESTful web services, including OAuth 2.0 authorization server implementations. The DefaultEncryptingCodeDataProvider class handles encrypted storage and lifecycle management of OAuth 2.0 authorization codes. Per RFC 6749 Section 4.1.2, an authorization code MUST be single-use; the authorization server must reject any reuse attempt. The flaw lies in the removeCodeGrant() method, which is responsible for expiring/invalidating the code once it has been exchanged for an access token. CWE-294 (Authentication Bypass by Capture-replay) applies: the code is not invalidated, allowing it to be replayed. An attacker who gains possession of the code through interception, log exposure, browser history, HTTP referrer leakage, or other means can reuse it to obtain multiple access tokens for the victim's account.
RemediationAI
Upgrade Apache CXF to version 4.2.3, 4.1.8, or 3.6.12 depending on the branch in use - these are the vendor-confirmed fixed releases per the Apache advisory at https://lists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o. If immediate upgrade is not feasible, deployments can mitigate by replacing DefaultEncryptingCodeDataProvider with a custom implementation that enforces single-use codes, at the cost of additional development and testing effort. Alternatively, rotating to short-lived authorization codes with very narrow expiry windows (e.g., 30-60 seconds) reduces the replay window but does not eliminate the underlying flaw. Enabling strict TLS with certificate pinning between authorization clients and the CXF server reduces code interception risk but does not fix the reuse vulnerability. Note that workarounds do not substitute for patching, as the root cause in removeCodeGrant() persists until the fixed version is deployed.
More in Apache Cxf
View allArbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
Unsafe deserialization in Apache CXF's JMS transport allows any party able to publish to the service's JMS destination t
Remote code execution in Apache CXF (versions before 3.6.11, 4.0.0-4.1.5, and 4.2.0) arises because the fix for CVE-2025
XML External Entity injection in Apache CXF's WSDL import processing allows attackers who can influence imported WSDL or
Denial of service persists in Apache CXF due to an incomplete remediation of CVE-2026-50645, allowing unauthenticated ne
Authorization scope escalation in Apache CXF's OAuth2 Dynamic Client Registration endpoint allows any registering client
XML External Entity injection in Apache CXF's WS-Transfer module exposes SOAP endpoints to server-side file read and int
Double-spending of OAuth2 authorization codes in Apache CXF's JCacheCodeDataProvider enables issuance of multiple valid
Apache CXF's JwtRequestCodeFilter blindly copies all claims from a validly-signed JWT request object into the OAuth2 aut
Authentication bypass in Apache CXF's OIDC relying-party implementation allows network-accessible attackers to forge sel
Token revocation bypass in Apache CXF's DefaultEncryptingOAuthDataProvider allows revoked OAuth access and refresh token
Authorization Code Substitution in Apache CXF's OpenID Connect Relying Party implementation allows remote attackers to h
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today