CVE-2026-57818 Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
Attackers can replay OAuth2 authorization codes via a race condition to obtain multiple valid access tokens, compromising user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57818?
CVE-2026-57818 is a high-severity vulnerability in Apache Cxf, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.
Weakness: CWE-367
Which versions are affected by CVE-2026-57818?
It affects 1 product.
Products include Apache Cxf.
How do I fix CVE-2026-57818?
Upgrade to a fixed version.
Is CVE-2026-57818 being exploited?
There is no known exploitation of CVE-2026-57818 in the wild and no public exploit code.
Other vulnerabilities in Apache Cxf
- CVE-2012-2379 XML Signature/Encryption Not Validated in Apache CXF
- CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
- CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
- CVE-2026-50628 Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
- CVE-2025-48913 Apache CXF: Untrusted JMS configuration can lead to RCE
Sources
Also known as GHSA-4qr2-3mpc-grqm.