CVE-2026-50631CWE-367

CVE-2026-50631

High · published June 12, 2026

CVSS v3.1

7.4

EPSS

Percentile

32.4

In the wild

Unconfirmed

What it is

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or threads. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

The record

Technical detail

CVSS v3.1: 7.4 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00393 · 32.4th percentile
Weakness: CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published: 2026-06-12T14:16Z

Affected products (2)

Product	Versions	Fixed in
apache/cxf	< 4.1.7	4.1.7
apache/cxf	≥ 4.2.0, < 4.2.2	4.2.2

References (2)

https://lists.apache.org/thread/s83t3x4r626o9h8rt0ryr1w7w53l1vv8 · [email protected]http://www.openwall.com/lists/oss-security/2026/06/11/8 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

12 JUN 08:59Z
Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing
cvelistv5