PUBLISHED
2026-08-06 12:16
MODIFIED
2026-08-06 12:16
EPSS (Prob. Exploit)
0.68%
Top 48.0%
> DESCRIPTION
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-294: Authentication Bypass by Capture-replay - A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
> RED HAT SECURITY ADVISORIES
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.
Red Hat build of Apache Camel 4.18.4 for Spring Boot patch release and security update is now available.
Red Hat Product Security has rated this update as having a security impact of
Important. A Com...
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
AFFECTED PACKAGES:
Unknown / Unknown
62 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
06/08/2026 12:16
Source: NVD
📊
ENRICHISSEMENT
01/09/2026 06:02
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-294: Authentication Bypass by Capture-replay - A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication...
Total des modifications: 1
Dernière mise à jour: 2 months ago