CVE-2026-57818CWE-367

CVE-2026-57818

High · published August 6, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
39.8
In the wild
Unconfirmed
What it is

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00472 · 39.8th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-08-06T16:16Z
Affected products (3)
ProductVersionsFixed in
apache/cxf< 3.6.123.6.12
apache/cxf≥ 4.0.0, < 4.1.84.1.8
apache/cxf≥ 4.2.0, < 4.2.34.2.3
References (2)
https://lists.apache.org/thread/7q08mz8bcbosp25wok7gr537zlp15mfz · [email protected]http://www.openwall.com/lists/oss-security/2026/08/06/20 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 06 AUG 11:24Z
    Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
    cvelistv5