HIGH

CVE-2026-57818

Apache Cxf 2026-08-06 CVSS v3.1

CVSS

8.1

Description

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.

Weakness (CWE)

CWE-367

EPSS Score

0.34%

Probability of exploitation in next 30 days

28th percentile

References

https://lists.apache.org/thread/7q08mz8bcbosp25wok7gr537zlp15mfz Mailing List, Vendor Advisory http://www.openwall.com/lists/oss-security/2026/08/06/20

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE