CVE-2026-73179

HighCVSS 8.1/10Last modified Oct 20, 2026

Description

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-then-delete operation against a shared relational database under READ_COMMITTED isolation. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fixes this issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache CXF	>= 4.2.0, < 4.2.4; >= 4.0.0, < 4.1.9; < 3.6.13

References

https://lists.apache.org/thread.html/6msbm601o6ogfgdzdbtbrmgspmz50nxkIssue Tracking, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/10/09/5Mailing List, Third Party Advisory

Timeline

Published: Oct 9, 2026
Last modified: Oct 20, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-73185.9A vulnerability was detected in elie mcp-project 0.1.0. The affected element is the function search_papers of the file research_server.py. T CVE-2026-731806.8Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed af CVE-2026-731817.5Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.CVE-2026-731827.1Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.CVE-2026-731839.3Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.CVE-2026-731847.1Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.CVE-2026-731859.3Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.CVE-2026-731868.8Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.CVE-2026-731879.3Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.CVE-2026-73197.3A flaw has been found in elinsky execution-system-mcp 0.1.0. The impacted element is the function _get_context_file_path of the file src/exe CVE-2026-731907.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-p CVE-2026-731916.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope. When the Syncope SRA is configured for CAS authent