Description
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache CXF | 4.2.0 – < 4.2.3, 4.0.0 – < 4.1.8, < 3.6.12 | 4.2.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | ovirt-engine-wildfly +1 | 24.0.1-4.el9 | ELSA-2026-500571 |
| Oracle Linux 8 | ovirt-engine-wildfly +1 | 24.0.1-4.el8 | ELSA-2026-500570 |
Advisories 3
- WID-SEC-2026-2682 Apache CXF: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- ELSA-2026-500571 Important: ovirt-engine-wildfly security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 4, 2026
- ELSA-2026-500570 Important: ovirt-engine-wildfly security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 4, 2026
References
- https://lists.apache.org/thread/7q08mz8bcbosp25wok7gr537zlp15mfz vendor-advisory