Loading vulnerability…
OAuth2 Authorization Code Replay in Apache CXF JCacheCodeDataProvider
CVE-2026-57818 is a time-of-check/time-of-use race condition in JCacheCodeDataProvider within Apache CXF's OAuth2 component. Concurrent redemption requests can cause a single OAuth2 authorization code to be accepted multiple times, resulting in multiple distinct, valid access tokens. Affected versions include 4.2.0 before 4.2.3, 4.0.0 before 4.1.8, and 3.6.x releases before 3.6.12. Apache rates the vulnerability as low severity.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The vulnerability violates OAuth2 authorization-code single-use guarantees by permitting multiple valid access tokens to be issued for one code. These tokens can potentially enable unauthorized access to resources covered by the associated authorization. Broader privilege escalation or access beyond that authorization is not established.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, reduce exposure by enforcing strict serialization or atomic handling of authorization code redemption in the OAuth2 token issuance path, and by monitoring for anomalous multiple token issuances tied to a single authorization grant. Because the vulnerability is rooted in concurrent redemption handling, limiting opportunities for parallel token requests may reduce risk, but upgrading to a fixed version is the definitive mitigation.
Patch, then assume compromise.
Upgrade Apache CXF to the applicable fixed release: 4.2.3, 4.1.8, or 3.6.12. For affected Tanzu Hub deployments, upgrade to release 11.0.0, which includes the security fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.