CVE-2026-68079
CriticalCVSS 9.8Summary
In Apache CXF's DefaultEncryptingCodeDataProvider, an authorization code can be redeemed an unlimited number of times due to a flaw in the removeCodeGrant implementation. This violates the RFC requirement that the authorization code must not be used more than once. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.
Risk Assessment
Risk of unauthorized access to protected resources through repeated use of an authorization code, potentially leading to session hijacking or unauthorized operations.
Recommendation
Immediately upgrade Apache CXF to versions 4.2.3, 4.1.8, or 3.6.12, which fix this vulnerability.
Original NVD description (English source)
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.