CVE-2026-73179: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Software Foundation Apache CXF

The vulnerability arises from improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider within Apache CXF. Under READ_COMMITTED isolation, concurrent token exchange requests can race the non-atomic find-then-delete operation against a shared relational database, enabling an attacker to reuse a single authorization code to obtain multiple valid access tokens. This is a classic TOCTOU race condition (CWE-367). The issue is resolved in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.

An attacker can exploit this race condition to obtain multiple valid access tokens from a single authorization code, potentially leading to unauthorized access to protected resources. This undermines the intended single-use nature of authorization codes in OAuth2 flows, increasing the risk of token replay and unauthorized resource access.

Users should upgrade Apache CXF to versions 4.2.4, 4.1.9, or 3.6.13 or later, where this race condition has been fixed. No other mitigations are specified. Patch status is confirmed by the vendor advisory.