Always-Incorrect Control Flow Implementation in Apache CXF - CVE-2026-68079
Published: August 24, 2026
Vulnerability identifier: #VU144832
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-68079
CWE-ID: CWE-670
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to redeem an authorization code multiple times.
The vulnerability exists due to improper authorization code invalidation in DefaultEncryptingCodeDataProvider when processing authorization code redemption. A remote attacker can reuse a captured authorization code to redeem an authorization code multiple times.
This issue violates the OAuth requirement that an authorization code must not be used more than once.
Affected software
Apache CXF
How to mitigate CVE-2026-68079
Install security update from vendor's website.
Apache CXF - addressed in versions 3.6.12, 4.1.8, 4.2.3