All vulnerabilities
CVE-2026-73179

Apache CXF: JPA authorization-code consume is non-atomic

Apache Software Foundation Apache CXF
Open in ThreatlineRecord JSON
CVSS
8.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.40%Chance of exploitation activity in the next 30 days, higher than 33% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.2.4Also 4.1.9, 3.6.13CVE List
Published9 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-then-delete operation against a shared relational database under READ_COMMITTED isolation. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fixes this issue.

Text from CVE List

Affected versions 3

  • Apache CXFaffected: 4.2.0 before 4.2.4CVE List
  • Apache CXFaffected: 4.0.0 before 4.1.9CVE List
  • Apache CXFaffected: all versions before 3.6.13CVE List

References 1