CVE-2026-73179

Overview

Apache CXF is an open-source services framework, maintained by the Apache Software Foundation, for building and consuming web services in Java. It implements the JAX-WS and JAX-RS APIs and supports SOAP, the WS-* standards, RESTful HTTP, and OAuth 2.0 over transports such as HTTP and JMS. Its modules are published as Maven artifacts under org.apache.cxf.

An authorization bypass vulnerability (CVE-2026-73179) has been identified in the JPA-backed OAuth2 authorization code grant provider of Apache CXF, which allows attackers to obtain multiple valid access tokens from a single authorization code by sending concurrent token exchange requests. This defeats the single-use guarantee that OAuth 2.0 places on authorization codes.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Apache CXF.

Details

Module Info

• Product: Apache CXF
• Affected packages: org.apache.cxf:cxf-rt-rs-security-oauth2
• Affected versions: <3.6.13, >=4.0.0 <4.1.9, >=4.2.0 <4.2.4
• GitHub repository: https://github.com/apache/cxf
• Published packages: https://central.sonatype.com/artifact/org.apache.cxf/cxf-rt-rs-security-oauth2
• Package manager: Maven
• Fixed in:
  
  • OSS Apache CXF 3.6.13, 4.1.9, 4.2.4
  • NES for Apache CXF v3.4.13, v3.5.14

Vulnerability Info

This Low-severity vulnerability is found in the org.apache.cxf:cxf-rt-rs-security-oauth2 package in multiple versions of Apache CXF.

When a client exchanges an authorization code for an access token, AuthorizationCodeGrantHandler calls removeCodeGrant(code) on the configured data provider and treats any non-null return value as a valid grant, then goes on to issue a token. In JPACodeDataProvider (and JPACMTCodeDataProvider, which inherits the same logic), consuming the code is implemented as a separate lookup and delete with no database lock:

private ServerAuthorizationCodeGrant removeCodeGrant(String code, EntityManager em) throws OAuthServiceException {
    ServerAuthorizationCodeGrant grant = em.getReference(ServerAuthorizationCodeGrant.class, code);
    try {
        em.remove(grant);
    } catch (EntityNotFoundException e) {
    }
    return grant;
}

The read and the delete are not atomic. When several token requests carrying the same code arrive at the same time and run in separate transactions against a shared relational database under READ_COMMITTED isolation, each transaction can load the grant row before any of them has committed its delete. Every one of those requests then receives the grant back, passes the expiry, client, redirect URI and code verifier checks, and is issued its own access token. An attacker who obtains or intercepts an authorization code, and can pass those checks for its client, can therefore race the legitimate client and redeem the same code more than once.

Mitigation

Only recent versions of Apache CXF are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Apache CXF release line (3.6.x or later) that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Guanping Zhang (finder)