CVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomic
Apache CXF's JPA OAuth2 provider can reuse one authorization code (CVE-2026-73179).
Apache CXF's JPA OAuth2 authorization-code grant provider does not atomically enforce single-use authorization codes. A remote attacker could obtain multiple valid tokens from one code. Affected cxf-rt-rs-security-oauth2 builds are versions before 3.6.13, 4.0.0 before 4.1.9, and 4.2.0 before 4.2.4. The disclosure rates severity as low, with no exploitation reported.
- Low-severity flaw in Apache CXF's JPA OAuth2 provider.
- Single-use authorization codes are not consumed atomically.
- Fixed in CXF 3.6.13, 4.1.9, and 4.2.4.
- CVEs
- CVE-2026-73179
- Vendors
- Apache
- Products
- Apache CXF
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73179 | OAuth2 auth-code race in Apache CXF JPA provider | 8.1 | — |
From the original article
Posted by Colm O hEigeartaigh on Oct 09 Severity: low Affected versions: - Apache CXF (org. apache. cxf:cxf-rt-rs-security-oauth2) 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.