CVE-2026-57818 describes a race condition in the JCacheCodeDataProvider component that permits an attacker to redeem a single authorization code multiple times by sending concurrent requests. This leads to multiple valid access tokens being issued from the same authorization code, violating the intended single-use constraint. The vulnerability is classified under CWE-367 (Time-of-check Time-of-use (TOCTOU) race condition). The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has released fixed versions 4.2.3, 4.1.8, and 3.6.12 to remediate this issue.

Exploitation of this race condition allows an attacker to obtain multiple valid access tokens from a single authorization code, potentially enabling unauthorized access to protected resources multiple times. This undermines the security model of single-use authorization codes and can lead to elevated privileges or unauthorized data access. The impact affects confidentiality, integrity, and availability of the affected system.

Users should upgrade to fixed versions 4.2.3, 4.1.8, or 3.6.12 of the affected software to remediate this vulnerability. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor's release of these versions.