CVE-2026-73179 is a high-severity race condition vulnerability in Apache CXF's JPA OAuth2 authorization code grant provider. It allows a remote attacker to obtain multiple valid access tokens from a single authorization code by exploiting a time-of-check to time-of-use (TOCTOU) flaw in the non-atomic find-then-delete operation under READ_COMMITTED isolation. This issue is fixed in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.
CVE-2026-57818 is a high-severity race condition vulnerability in Apache CXF's JCacheCodeDataProvider component. It allows an attacker to redeem a single authorization code multiple times through concurrent requests, resulting in multiple valid access tokens being issued. This flaw can lead to unauthorized access and potential privilege escalation. Fixed versions 4.2.3, 4.1.8, and 3.6.12 address this issue.
Apache CXF's OAuth2 Dynamic Client Registration endpoint improperly accepts and stores the 'scope' parameter from client registration requests without validating it against an allowlist. This allows clients to self-assign privileged scopes during registration. The issue affects multiple versions prior to 3.6.12, 4.1.8, and 4.2.3. Users are advised to upgrade to these fixed versions to mitigate the vulnerability.
Apache CXF contains a vulnerability in its JwtRequestCodeFilter where security-sensitive parameters from a signed JWT are copied into the authorization parameter map without proper exclusion. This allows an attacker who can produce a validly-signed JWT (for example, if the client_secret is compromised) to substitute critical parameters such as code_challenge, code_challenge_method, nonce, and state, undermining PKCE integrity and OpenID Connect replay protection. Fixed versions 4.2.3, 4.1.8, and 3.6.12 address this issue.
CVE-2026-68079 is a critical authentication bypass vulnerability in Apache CXF's DefaultEncryptingCodeDataProvider. The flaw allows a captured authorization code to be redeemed multiple times, violating the RFC requirement that authorization codes must only be used once. This issue affects multiple versions of Apache CXF prior to 4.2.3, 4.1.8, and 3.6.12, which contain the fixes.
Apache CXF's DefaultEncryptingOAuthDataProvider improperly handles revoked access and refresh tokens, allowing them to decrypt successfully and report as active via TokenIntrospectionService. This behavior violates RFC requirements that revoked tokens must be invalidated and introspection must return active:false. The issue affects multiple versions prior to fixed releases. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12 where the problem is resolved.
CVE-2026-50631 is a high-severity race condition vulnerability in Apache CXF's AbstractOAuthDataProvider. It allows concurrent requests using the same refresh token to bypass single-use restrictions and generate multiple valid access tokens when 'recycleRefreshTokens' is set to false. This flaw can enable attackers to replay a leaked refresh token concurrently, potentially compromising access control. Fixed versions include 4.2.2, 4.1.7, and 3.6.12.
CVE-2026-50630 is a CRLF injection vulnerability in Apache CXF's OAuth2 AuthorizationUtils class. The vulnerability occurs because the 'realm' parameter in the WWW-Authenticate response header is concatenated without sanitizing carriage return and line feed characters. This allows an attacker controlling the realm value to inject arbitrary HTTP headers or split the HTTP response. The issue is fixed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12.
CVE-2026-50629 is a medium severity vulnerability in Apache CXF where the 'clientId' parameter from HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This improper neutralization of CRLF sequences allows attackers to inject arbitrary content, including fake log entries, into server logs. The issue is fixed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12.
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this
security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
CVE-2026-50623 is an authentication bypass vulnerability in Apache CXF's OAuth2 TokenIntrospectionService. The flaw is due to a missing 'throw' keyword in the security context check, allowing unauthenticated access to the introspection endpoint if authentication is not enabled. The issue is fixed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12. The vulnerability has a medium severity with a CVSS score of 4.8.