CVE-2026-68079CWE-294

CVE-2026-68079

Critical · published August 6, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
51.9
In the wild
Unconfirmed
What it is

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00682 · 51.9th percentile
Weakness
CWE-294 · Authentication Bypass by Capture-replay
Published
2026-08-06T16:16Z
Affected products (3)
ProductVersionsFixed in
apache/cxf< 3.6.123.6.12
apache/cxf≥ 4.0.0, < 4.1.84.1.8
apache/cxf≥ 4.2.0, < 4.2.34.2.3
References (2)
https://lists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o · [email protected]http://www.openwall.com/lists/oss-security/2026/08/06/24 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 06 AUG 11:22Z
    Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
    cvelistv5