{"id":"CVE-2026-73179","published":"2026-10-09T11:17:02.817","lastModified":"2026-10-15T17:17:27.263","description":"Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-then-delete operation against a shared relational database under READ_COMMITTED isolation. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fixes this issue.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-367"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/6msbm601o6ogfgdzdbtbrmgspmz50nxk","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/09/5","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows attackers to reuse a single OAuth2 authorization code multiple times to obtain valid access tokens, bypassing the intended single-use restriction. This creates a race condition in database operations that can be exploited concurrently to generate unlimited access tokens from one valid authorization code.","exploitability":"Exploitation requires concurrent HTTP requests to the token endpoint using a valid authorization code, with minimal preconditions beyond having access to a legitimate authorization code and network access to the vulnerable server.","blast_radius":"The impact could be significant as attackers could gain unauthorized access to protected resources using stolen or leaked authorization codes, potentially leading to full system compromise if those tokens have broad permissions.","remediation":"Upgrade to Apache CXF version 4.2.4, 4.1.9, or 3.6.13 which fixes the race condition in the OAuth2 authorization code handling.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["oauth2","authorization","race-condition","database"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:59:01.269Z"}}