EUVD-2026-53862
GHSA-4qr2-3mpc-grqm
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-exploitable but AC:H due to race window timing; code possession is a prerequisite but not a privilege level; confidentiality high for unauthorized token issuance, integrity low, no availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.
AnalysisAI
Double-spending of OAuth2 authorization codes in Apache CXF's JCacheCodeDataProvider enables issuance of multiple valid access tokens from a single code. Concurrent requests to the token endpoint during the brief window between code validation and invalidation exploit the TOCTOU race condition (CWE-367), allowing an attacker in possession of a valid authorization code to obtain additional access tokens beyond the one they are entitled to. No public exploit has been identified at time of analysis, and fixed versions are available across all maintained branches.
Technical ContextAI
Apache CXF (CPE: cpe:2.3:a:apache_software_foundation:apache_cxf:*:*:*:*:*:*:*:*) is a widely-deployed Java framework for building SOAP and REST web services, including OAuth2 authorization server functionality. The JCacheCodeDataProvider component manages authorization code storage and redemption using the JCache (JSR-107) caching API. The root cause is CWE-367 (Time-of-Check Time-of-Use): the check confirming an authorization code is unredeemed and the subsequent invalidation of that code are not performed as an atomic operation. In the OAuth2 authorization code flow, codes must be single-use per RFC 6749 Section 4.1.2. Because JCache operations are non-atomic in the affected implementation, a window exists between the validity check and the deletion where multiple concurrent redemption requests all pass the check before any invalidation occurs, each receiving a distinct, valid access token.
RemediationAI
Upgrade to Apache CXF 4.2.3, 4.1.8, or 3.6.12, which resolve the race condition by making authorization code redemption atomic. The vendor advisory is available at https://lists.apache.org/thread/7q08mz8bcbosp25wok7gr537zlp15mfz. If an immediate upgrade is not feasible, a compensating control is to replace JCacheCodeDataProvider with a database-backed authorization code store that enforces atomic compare-and-delete semantics (e.g., via SELECT FOR UPDATE or equivalent), which eliminates the TOCTOU window at the persistence layer. Alternatively, placing a distributed lock or serialization layer in front of the token endpoint for code exchanges would prevent concurrent redemption attempts, though this introduces latency and a potential single point of failure. Rate-limiting the token endpoint per client_id and code value can reduce the exploitability window but does not eliminate it.
More in Apache Cxf
View allArbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
Unsafe deserialization in Apache CXF's JMS transport allows any party able to publish to the service's JMS destination t
Remote code execution in Apache CXF (versions before 3.6.11, 4.0.0-4.1.5, and 4.2.0) arises because the fix for CVE-2025
XML External Entity injection in Apache CXF's WSDL import processing allows attackers who can influence imported WSDL or
Denial of service persists in Apache CXF due to an incomplete remediation of CVE-2026-50645, allowing unauthenticated ne
Authorization scope escalation in Apache CXF's OAuth2 Dynamic Client Registration endpoint allows any registering client
XML External Entity injection in Apache CXF's WS-Transfer module exposes SOAP endpoints to server-side file read and int
Apache CXF's JwtRequestCodeFilter blindly copies all claims from a validly-signed JWT request object into the OAuth2 aut
Authentication bypass in Apache CXF's OIDC relying-party implementation allows network-accessible attackers to forge sel
Apache CXF's DefaultEncryptingCodeDataProvider allows captured OAuth 2.0 authorization codes to be redeemed an unlimited
Token revocation bypass in Apache CXF's DefaultEncryptingOAuthDataProvider allows revoked OAuth access and refresh token
Authorization Code Substitution in Apache CXF's OpenID Connect Relying Party implementation allows remote attackers to h
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today