CVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomic
Apache CXF's JPA OAuth2 provider can reuse one authorization code (CVE-2026-73179).
32
CVE-2026-73179
OAuth2 auth-code race in Apache CXF JPA provider
- CVSS 3.1
- 8.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache CXF’s JPA OAuth2 authorization-code grant provider does not atomically enforce single-use semantics for authorization codes. A remote attacker who already holds a valid authorization code can send concurrent token-exchange requests that race a non-atomic find-then-delete against a shared relational database running under READ COMMITTED isolation, and receive multiple valid access tokens from that one code. Impact is limited to deployments that use this JPA OAuth2 provider, not every Apache CXF installation. Fixed releases are 4.2.4, 4.1.9, and 3.6.13. There is no known public proof of concept and no report of exploitation in the wild.
What to do: Upgrade Apache CXF to 4.2.4, 4.1.9, or 3.6.13. Until then, treat any deployment that stores OAuth2 authorization codes in a shared relational database via the JPA provider as able to mint more than one access token from one code, and review token-endpoint logs for concurrent exchanges of the same code.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache CXF (JPA OAuth2 authorization code grant provider) | versions before 4.2.4, 4.1.9, and 3.6.13 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-then-delete operation against a shared relational database under READ_COMMITTED isolation. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fixes this issue.