CVE-2026-68079

Summary

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Affected Software

VendorProductVersion RangeStatus
Apache Software FoundationApache CXF4.2.0 < 4.2.3affected
Apache Software FoundationApache CXF4.0.0 < 4.1.8affected
Apache Software FoundationApache CXF0 < 3.6.12affected

Weaknesses

  • CWE-294: CWE-294 Authentication Bypass by Capture-replay

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

CVE Program Container

Additional References

References