identity-authentication-vulnerabilityopen-source-dependency-vulnerabilitywidely-deployed-product-advisory
Apache CXF OAuth2 Flaw Allows Authorization Code Replay via Race Condition
Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Aug 6, 2026
Apache CXF disclosed CVE-2026-57818, a low-severity flaw in the OAuth2 component org.apache.cxf:cxf-rt-rs-security-oauth2 that can let a single authorization code be redeemed multiple times. The issue stems from a time-of-check/time-of-use race condition in JCacheCodeDataProvider, allowing concurrent requests to obtain multiple distinct valid access tokens from one OAuth2 authorization code.
The vulnerability affects Apache CXF 4.2.0 before 4.2.3, 4.0.0 before 4.1.8, and 3.6.x before 3.6.12. Apache advised users to upgrade to 4.2.3, 4.1.8, or 3.6.12 to remediate the issue, and credited Guanping Zhang with reporting the bug.
Do you run this?See affected versions and whether adversaries are exploiting it.
Check your exposure
