Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-57818

Опубликовано: 06 авг. 2026
Источник: redhat
CVSS3: 4.2
EPSS Низкий

Описание

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.

A flaw was found in Apache CXF. A race condition in the JCacheCodeDataProvider allows a remote attacker to redeem a single authorization code multiple times through concurrent requests. This can result in the issuance of multiple distinct, valid access tokens, potentially leading to unauthorized access or session hijacking.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat build of Apache Camel for Spring Boot 4cxf-rt-rs-security-oauth2Affected
Red Hat JBoss Web Server 5cxf-rt-rs-security-oauth2Out of support scope

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-639
https://bugzilla.redhat.com/show_bug.cgi?id=2511992org.apache.cxf/cxf: Apache CXF: Authorization Code Replay via Race Condition

EPSS

Процентиль: 27%
0.00344
Низкий

4.2 Medium

CVSS3

Связанные уязвимости

CVSS3: 8.1
nvd
около 1 месяца назад

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.

CVSS3: 8.1
github
около 1 месяца назад

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.

EPSS

Процентиль: 27%
0.00344
Низкий

4.2 Medium

CVSS3