CVE-2026-57818
Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.
- Record
CVE-2026-57818- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-367
- Updated
- 2026-11-02
EUVDEUVD-2026-53862
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.
- Record
EUVD-2026-53862- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4qr2-3mpc-grqm
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization...
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.
- Record
GHSA-4qr2-3mpc-grqm- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-367
- Updated
- 2026-11-02
NVD
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.
- Record
CVE-2026-57818- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-367
- Updated
- 2026-11-02
OSV
Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.
- Record
CVE-2026-57818- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-367
- Updated
- 2026-11-02
OSVRHLW-2026-2d8697b26ccd16c3
Lightwell Security Advisory: cxf-rt-rs-security-oauth2 4.2.2.rhlw-00006
Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 4.2.2.rhlw-00006 with backported fixes for CVE-2026-57818, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481.
CVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
CVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters
CVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
CVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider
This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-oauth2 4.2.2 from Maven Central.
- Record
RHLW-2026-2d8697b26ccd16c3- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHLW-2026-fd244c7ea4e4e9e4
Lightwell Security Advisory: cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003
Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003 with backported fixes for CVE-2026-50623, CVE-2026-50627, CVE-2026-50628, CVE-2026-50629, CVE-2026-50630, CVE-2026-50631, CVE-2026-57818, CVE-2026-61466, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481.
CVE-2026-50623: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
CVE-2026-50627: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator
CVE-2026-50628: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
CVE-2026-50629: Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier
CVE-2026-50630: Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection
CVE-2026-50631: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing
CVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
CVE-2026-61466: Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
CVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters
CVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
CVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider
This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9 from Maven Central.
- Record
RHLW-2026-fd244c7ea4e4e9e4- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-rt-rs-security-oauth2Red Hat Lightwell:Maven From an advisory covering 4 CVEs |
4.2.2 up to 4.2.2.rhlw-00006 | 4.2.2.rhlw-00006 |
org.apache.cxf:cxf-rt-rs-security-oauth2Red Hat Lightwell:Maven From an advisory covering 11 CVEs |
before 3.6.9.rhlw-00003, plus listed versions 2.6.02.6.12.6.102.6.112.6.12 Show 45 moreShow less2.6.132.6.142.6.152.6.162.6.172.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.02.7.12.7.102.7.112.7.122.7.132.7.142.7.152.7.162.7.172.7.182.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.93.0.03.0.0-milestone13.0.0-milestone23.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.163.0.23.0.3 |
3.6.9.rhlw-00003 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-57818 is a high vulnerability (CVSS 8.1) in Apache Cxf, published August 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. No source names a fixed version.
References
lists.apache.org/thread/7q08mz8bcbosp25wok7gr537zlp15mfz
openwall.com/lists/oss-security/2026/08/06/20
nvd.nist.gov/vuln/detail/CVE-2026-57818
github.com/advisories/GHSA-4qr2-3mpc-grqm
repo.maven.apache.org/maven2
Show 41 moreShow less
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50627.json
access.redhat.com/errata/RHSA-2026:37390
Left out here: 87 versions. The JSON record has them.