Package · Maven

org.apache.cxf:cxf-rt-rs-security-oauth2

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

High 7.4

CVE-2026-50631

Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed…

Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-rs-security-oauth2 Maven

Jun 12, 2026