CVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomic

As cited

Copy frozen at 2026-10-09 13:24 UTC (site build).

vulnerabilities

CVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomic

Apache CXF versions before 3.6.13, 4.1.9, and 4.2.4 contain a flaw in the JPA OAuth2 authorization code provider that fails to enforce single-use semantics on authorization codes. The vulnerability allows remote attackers to reuse authorization codes to obtain multiple valid tokens. The issue is rated low severity.

Why it matters: Organizations deploying Apache CXF for OAuth2 authorization should upgrade affected versions to prevent attackers from obtaining additional tokens through authorization code reuse.

Source published

2026-10-09 10:14 UTC

First seen by Cybersecurity Tracker

2026-10-09 11:33 UTC