GitHub Advisoryadvisory · Maven

GHSA-83r6-96m8-r52p Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing

HIGH Published 2026-06-12 Modified 2026-08-20 Official page ↗
Aliases
CVE-2026-50631
Ecosystem
Maven
Packages
org.apache.cxf:cxf-rt-rs-security-oauth2
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-367
Reviewed
2026-08-20

Affected packages

• Maven org.apache.cxf:cxf-rt-rs-security-oauth2: >= 4.2.0, < 4.2.2 → fixed in 4.2.2 • Maven org.apache.cxf:cxf-rt-rs-security-oauth2: < 4.1.7 → fixed in 4.1.7

Description

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or threads. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2026-50631 A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and… vulnerability

Weakness · CWE (1)

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References