CVE-2026-68079: CWE-294 Authentication Bypass by Capture-replay in Apache Software Foundation Apache CXF
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
AI Analysis
Technical Summary
CVE-2026-68079 is an authentication bypass vulnerability in Apache CXF's DefaultEncryptingCodeDataProvider. The flaw lies in the removeCodeGrant functionality, which fails to prevent reuse of captured authorization codes. This allows an attacker to redeem an authorization code multiple times, contrary to the RFC mandate that authorization codes must be used only once. The issue is resolved in Apache CXF versions 4.2.3, 4.1.8, and 3.6.12.
Potential Impact
The vulnerability enables an attacker who has captured an authorization code to reuse it an unlimited number of times, potentially bypassing authentication controls. This undermines the security guarantees of the authorization process and could lead to unauthorized access if exploited.
Mitigation Recommendations
Users are advised to upgrade Apache CXF to versions 4.2.3, 4.1.8, or 3.6.12 where this issue is fixed. No other mitigation or temporary workaround is indicated in the available data. Patch status is confirmed by the vendor advisory stating fixed versions.
CVE-2026-68079: CWE-294 Authentication Bypass by Capture-replay in Apache Software Foundation Apache CXF
Description
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Affected software
pkg:maven/Apache Software Foundation/org.apache.cxf:cxf-rt-rs-security-oauth2Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-68079 is an authentication bypass vulnerability in Apache CXF's DefaultEncryptingCodeDataProvider. The flaw lies in the removeCodeGrant functionality, which fails to prevent reuse of captured authorization codes. This allows an attacker to redeem an authorization code multiple times, contrary to the RFC mandate that authorization codes must be used only once. The issue is resolved in Apache CXF versions 4.2.3, 4.1.8, and 3.6.12.
Potential Impact
The vulnerability enables an attacker who has captured an authorization code to reuse it an unlimited number of times, potentially bypassing authentication controls. This undermines the security guarantees of the authorization process and could lead to unauthorized access if exploited.
Mitigation Recommendations
Users are advised to upgrade Apache CXF to versions 4.2.3, 4.1.8, or 3.6.12 where this issue is fixed. No other mitigation or temporary workaround is indicated in the available data. Patch status is confirmed by the vendor advisory stating fixed versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-07-30T09:22:10.738Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a74768bbf8831d539a9b745
Added to database: 08/06/2026, 11:56:59 UTC
Last enriched: 08/06/2026, 12:16:08 UTC
Last updated: 08/06/2026, 12:52:02 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.