PUBLISHED
2026-06-12 10:16
MODIFIED
2026-06-12 10:16
EPSS (Prob. Exploit)
0.29%
Top 78.1%
> DESCRIPTION
A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or threads. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition - The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
> GITHUB SECURITY ADVISORY
GHSA-83r6-96m8-r52p
HIGH
Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing
AFFECTED PACKAGES:
MAVEN / org.apache.cxf:cxf-rt-rs-security-oauth2
< 4.1.7
Fixed in: 4.1.7
MAVEN / org.apache.cxf:cxf-rt-rs-security-oauth2
>= 4.2.0, < 4.2.2
Fixed in: 4.2.2
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing
AFFECTED PACKAGES:
Unknown / Unknown
48 versions affected
ALIASES:
GHSA-83r6-96m8-r52p
> HISTORIQUE DES MODIFICATIONS
Première apparition
12/06/2026 10:16
Source: NVD
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition - The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in...
Total des modifications: 1
Dernière mise à jour: 4 months ago