{"id":"CVE-2026-57818","aliases":["EUVD-2026-53862","GHSA-4qr2-3mpc-grqm","GHSA-542g-m3fx-q86f","GHSA-83r6-96m8-r52p","GHSA-9mrv-8pvf-hf4m","GHSA-f8p7-h97q-7vx7","GHSA-g5v7-jchf-7jrr","GHSA-xf62-wr5p-5p95","RHLW-2026-2d8697b26ccd16c3","RHLW-2026-fd244c7ea4e4e9e4"],"status":"published","title":"Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider","description":"A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00472,"percentile":0.41289,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-367"],"published":"2026-08-06T11:24:53Z","modified":"2026-10-29T14:30:06Z","affected":[{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2"},{"fixed":"4.2.2.rhlw-00006"}]}],"versions":["4.2.2"],"bundled":4},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9.rhlw-00003"}]}],"versions":["2.6.0","2.6.1","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.16","2.6.17","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.16","2.7.17","2.7.18","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","3.0.0","3.0.0-milestone1","3.0.0-milestone2","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.3.0","3.3.1","3.3.10","3.3.11","3.3.12","3.3.13","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.3.8","3.3.9","3.4.0","3.4.1","3.4.10","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9","3.5.0","3.5.1","3.5.10","3.5.11","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.6.8","3.6.9"],"bundled":11}],"products":[{"vendor":"apache","product":"cxf"},{"vendor":"apache software foundation","product":"apache cxf"}],"references":[{"url":"https://lists.apache.org/thread/7q08mz8bcbosp25wok7gr537zlp15mfz","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/06/20","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57818","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4qr2-3mpc-grqm"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57818.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63687.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/drcq4chmt0btx86f17o47j17r378hzpw","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63687","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68079.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68079","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68481.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/88c0h10yjb2b8201o1km3st71fs2zw2b","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68481","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50623.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/ydzj8m5mqmjy13xgyj9mkk9hfff63qq7","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50623","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-542g-m3fx-q86f","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50627.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50627","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50627.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/0jfzz9q992957b99tw7hodcqjfyxwb1m","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50627","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9mrv-8pvf-hf4m","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50628.json","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50628","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50628.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/vb3ho8lf228gh90m1fpnohf2008xrdxk","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50628","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g5v7-jchf-7jrr","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50629.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/xw95po30p8th58ms1no6b0f2375cql00","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50629","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f8p7-h97q-7vx7","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50630.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/bt7vnjzzkpd6vdhkxv103poor1jy5trm","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50630","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xf62-wr5p-5p95","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50631.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/s83t3x4r626o9h8rt0ryr1w7w53l1vv8","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50631","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-83r6-96m8-r52p","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61466.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/2l1r16g79tpxd7fzrzr2q9oscwrjgljs","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61466","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-57818","title":"Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider","description":"A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T11:24:53.59Z","modified":"2026-08-07T00:01:42.058Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T13:43:44.898272Z"}],"euvd":[{"id":"EUVD-2026-53862","description":"A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T11:24:53Z","modified":"2026-08-07T00:01:42Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:07.757838Z"}],"ghsa":[{"id":"GHSA-4qr2-3mpc-grqm","title":"A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization...","description":"A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T12:31:14Z","modified":"2026-08-07T00:31:10Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:10:10.387883Z"}],"nvd":[{"id":"CVE-2026-57818","description":"A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T12:16:27.373Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"CVE-2026-57818","title":"Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider","description":"A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T11:24:53.59Z","modified":"2026-10-28T02:30:44.489744497Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"RHLW-2026-2d8697b26ccd16c3","title":"Lightwell Security Advisory: cxf-rt-rs-security-oauth2 4.2.2.rhlw-00006","description":"Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 4.2.2.rhlw-00006 with backported fixes for CVE-2026-57818, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481.\n\nCVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider\n\nCVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters\n\nCVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay\n\nCVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider\n\nThis patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-oauth2 4.2.2 from Maven Central.","status":"published","published":"2026-10-13T21:10:22Z","modified":"2026-10-29T14:30:06.255083295Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-fd244c7ea4e4e9e4","title":"Lightwell Security Advisory: cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003","description":"Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003 with backported fixes for CVE-2026-50623, CVE-2026-50627, CVE-2026-50628, CVE-2026-50629, CVE-2026-50630, CVE-2026-50631, CVE-2026-57818, CVE-2026-61466, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481.\n\nCVE-2026-50623: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService\n\nCVE-2026-50627: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator\n\nCVE-2026-50628: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control\n\nCVE-2026-50629: Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier\n\nCVE-2026-50630: Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection\n\nCVE-2026-50631: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing\n\nCVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider\n\nCVE-2026-61466: Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation\n\nCVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters\n\nCVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay\n\nCVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider\n\nThis patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9 from Maven Central.","status":"published","published":"2026-10-13T21:10:18Z","modified":"2026-10-27T04:13:03.043123153Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:59.135214Z"}]}}