CVE-2026-68079
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
| CWE | CWE-294 |
| Vendor | apache software foundation |
| Product | apache cxf |
| Published | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache cxf
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache cxf are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache CXF
4.2.0 < 4.2.3 4.0.0 < 4.1.8 0 < 3.6.12
References
Credits
Guanping Zhang reported this vulnerability