CVE-2026-68079

9.8 Critique

Publiée le 06/08/2026 à 14:16 · Modifiée le 07/08/2026 à 02:16 · Modifiée · Source : security@apache.org

Description

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache CXF
Apache cxf

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-294

Références

https://lists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/06/24

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories