{"id":"CVE-2026-68079","aliases":["EUVD-2026-53858","GHSA-542g-m3fx-q86f","GHSA-7mxw-qv85-693m","GHSA-83r6-96m8-r52p","GHSA-9mrv-8pvf-hf4m","GHSA-f8p7-h97q-7vx7","GHSA-g5v7-jchf-7jrr","GHSA-xf62-wr5p-5p95","RHLW-2026-2d8697b26ccd16c3","RHLW-2026-fd244c7ea4e4e9e4"],"status":"published","title":"Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay","description":"In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that \"The authorization code MUST NOT be used more than once.\" Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00682,"percentile":0.52753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-294"],"published":"2026-08-06T11:22:57Z","modified":"2026-10-29T14:30:06Z","affected":[{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2"},{"fixed":"4.2.2.rhlw-00006"}]}],"versions":["4.2.2"],"bundled":4},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9.rhlw-00003"}]}],"versions":["2.6.0","2.6.1","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.16","2.6.17","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.16","2.7.17","2.7.18","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","3.0.0","3.0.0-milestone1","3.0.0-milestone2","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.3.0","3.3.1","3.3.10","3.3.11","3.3.12","3.3.13","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.3.8","3.3.9","3.4.0","3.4.1","3.4.10","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9","3.5.0","3.5.1","3.5.10","3.5.11","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.6.8","3.6.9"],"bundled":11}],"products":[{"vendor":"apache","product":"cxf"},{"vendor":"apache software foundation","product":"apache cxf"}],"references":[{"url":"https://lists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/06/24","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68079","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7mxw-qv85-693m"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68079.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57818.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/7q08mz8bcbosp25wok7gr537zlp15mfz","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57818","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63687.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/drcq4chmt0btx86f17o47j17r378hzpw","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63687","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68481.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/88c0h10yjb2b8201o1km3st71fs2zw2b","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68481","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50623.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/ydzj8m5mqmjy13xgyj9mkk9hfff63qq7","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50623","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-542g-m3fx-q86f","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50627.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50627","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50627.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/0jfzz9q992957b99tw7hodcqjfyxwb1m","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50627","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9mrv-8pvf-hf4m","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50628.json","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50628","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50628.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/vb3ho8lf228gh90m1fpnohf2008xrdxk","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50628","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g5v7-jchf-7jrr","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50629.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/xw95po30p8th58ms1no6b0f2375cql00","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50629","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f8p7-h97q-7vx7","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50630.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/bt7vnjzzkpd6vdhkxv103poor1jy5trm","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50630","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xf62-wr5p-5p95","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50631.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/s83t3x4r626o9h8rt0ryr1w7w53l1vv8","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50631","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-83r6-96m8-r52p","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61466.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/2l1r16g79tpxd7fzrzr2q9oscwrjgljs","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61466","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-68079","title":"Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay","description":"In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that \"The authorization code MUST NOT be used more than once.\" Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T11:22:57.938Z","modified":"2026-08-07T00:01:53.998Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T13:45:59.110885Z"}],"euvd":[{"id":"EUVD-2026-53858","description":"In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that \"The authorization code MUST NOT be used more than once.\" Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T11:22:57Z","modified":"2026-08-07T00:01:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:02:07.757838Z"}],"ghsa":[{"id":"GHSA-7mxw-qv85-693m","title":"In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed...","description":"In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that \"The authorization code MUST NOT be used more than once.\" Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T12:31:14Z","modified":"2026-08-07T00:31:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T15:10:10.387883Z"}],"nvd":[{"id":"CVE-2026-68079","description":"In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that \"The authorization code MUST NOT be used more than once.\" Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T12:16:28.06Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"CVE-2026-68079","title":"Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay","description":"In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that \"The authorization code MUST NOT be used more than once.\" Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T11:22:57.938Z","modified":"2026-10-28T02:30:56.123706856Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"RHLW-2026-2d8697b26ccd16c3","title":"Lightwell Security Advisory: cxf-rt-rs-security-oauth2 4.2.2.rhlw-00006","description":"Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 4.2.2.rhlw-00006 with backported fixes for CVE-2026-57818, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481.\n\nCVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider\n\nCVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters\n\nCVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay\n\nCVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider\n\nThis patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-oauth2 4.2.2 from Maven Central.","status":"published","published":"2026-10-13T21:10:22Z","modified":"2026-10-29T14:30:06.255083295Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-fd244c7ea4e4e9e4","title":"Lightwell Security Advisory: cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003","description":"Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003 with backported fixes for CVE-2026-50623, CVE-2026-50627, CVE-2026-50628, CVE-2026-50629, CVE-2026-50630, CVE-2026-50631, CVE-2026-57818, CVE-2026-61466, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481.\n\nCVE-2026-50623: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService\n\nCVE-2026-50627: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator\n\nCVE-2026-50628: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control\n\nCVE-2026-50629: Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier\n\nCVE-2026-50630: Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection\n\nCVE-2026-50631: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing\n\nCVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider\n\nCVE-2026-61466: Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation\n\nCVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters\n\nCVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay\n\nCVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider\n\nThis patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9 from Maven Central.","status":"published","published":"2026-10-13T21:10:18Z","modified":"2026-10-27T04:13:03.043123153Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:59.135214Z"}]}}