This vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition in Apache CXF's AbstractOAuthDataProvider component. When the configuration parameter 'recycleRefreshTokens' is false, concurrent requests using the same refresh token can bypass the intended single-use semantics, resulting in multiple valid access tokens being issued from a single refresh token. This can lead to unauthorized access if a refresh token is leaked and replayed concurrently by multiple attackers or threads. The issue is resolved in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12.

An attacker with access to a leaked refresh token can exploit this race condition to generate multiple valid access tokens concurrently, potentially escalating access privileges or maintaining unauthorized access. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS v3.1 base score is 7.4 (High), reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Users are strongly advised to upgrade Apache CXF to versions 4.2.2, 4.1.7, or 3.6.12 where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor advisory stating fixed versions. Until upgraded, avoid configurations with 'recycleRefreshTokens' set to false if possible.