8.1Hoch
CVE-2026-57818Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
Beschreibung
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.
Schwachstellentyp (CWE):
CWE-367
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Apache Software Foundation | Apache CXF | 4.2.0 – < 4.2.3, 4.0.0 – < 4.1.8, < 3.6.12 | |
| apache | cxf | < 3.6.12 |
Referenzen und Patches
- https://lists.apache.org/thread/7q08mz8bcbosp25wok7gr537zlp15mfz vendor-advisoryMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/08/06/20
CPE-Treffer (NVD) (3)
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*< 3.6.12cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.1.8cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*≥ 4.2.0 < 4.2.3