CVE-2026-73179
published 2026-10-09CVE-2026-73179: Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to…
PriorityP352high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.40%
33.2th percentile
Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-then-delete operation against a shared relational database under READ_COMMITTED isolation. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fixes this issue.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | cxf | < 3.6.13 | 3.6.13 |
| apache | cxf | >= 4.0.0 < 4.1.9 | 4.1.9 |
| apache | cxf | >= 4.2.0 < 4.2.4 | 4.2.4 |
| apache_software_foundation | apache_cxf | < 3.6.13 | 3.6.13 |
| apache_software_foundation | apache_cxf | >= 4.0.0 < 4.1.9 | 4.1.9 |
| apache_software_foundation | apache_cxf | >= 4.2.0 < 4.2.4 | 4.2.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache CXF up to 3.6.12/4.1.8/4.2.3 JPA OAuth2 Authorization Code Grant Provider race condition (EUVD-2026-95695 / WID-SEC-2026-3824)
vuldb·2026-10-15·CVSS 8.1
CVE-2026-73179 [HIGH] Apache CXF up to 3.6.12/4.1.8/4.2.3 JPA OAuth2 Authorization Code Grant Provider race condition (EUVD-2026-95695 / WID-SEC-2026-3824)
A vulnerability classified as problematic was found in Apache CXF up to 3.6.12/4.1.8/4.2.3. The affected element is an unknown function of the component JPA OAuth2 Authorization Code Grant Provider. Executing a manipulation can lead to race condition.
This vulnerability appears as CVE-2026-73179. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is advised.
GHSA
Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a
ghsa_unreviewed·2026-10-09
CVE-2026-73179 CWE-367 Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a
Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-then-delete operation against a shared relational database under READ_COMMITTED isolation. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fixes this issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-09
Published