CVE-2026-50631 describes a race condition in AbstractOAuthDataProvider where concurrent requests using the same refresh token can bypass the intended single-use semantics. When the configuration option 'recycleRefreshTokens' is false, multiple valid access tokens can be generated from the same refresh token. This flaw allows an attacker or multiple threads to replay a leaked refresh token concurrently, potentially escalating access. The vulnerability has a CVSS 3.1 score of 7.4 (high severity) with network attack vector, high impact on confidentiality and integrity, and no privileges or user interaction required. The issue is resolved by upgrading to versions 4.2.2 or 4.1.7.

An attacker with access to a leaked refresh token can exploit this race condition to generate multiple valid access tokens concurrently, bypassing the intended single-use restriction of refresh tokens. This can lead to unauthorized access and compromise of confidentiality and integrity of the affected system. Availability is not impacted.

Users should upgrade to AbstractOAuthDataProvider versions 4.2.2 or 4.1.7, which include fixes for this race condition vulnerability. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory recommending these versions.