CVE-2026-73179

Summary

The flaw allows attackers to reuse a single OAuth2 authorization code multiple times to obtain valid access tokens, bypassing the intended single-use restriction. This creates a race condition in database operations that can be exploited concurrently to generate unlimited access tokens from one valid authorization code.

Exploitability

Exploitation requires concurrent HTTP requests to the token endpoint using a valid authorization code, with minimal preconditions beyond having access to a legitimate authorization code and network access to the vulnerable server.

Blast radius

The impact could be significant as attackers could gain unauthorized access to protected resources using stolen or leaked authorization codes, potentially leading to full system compromise if those tokens have broad permissions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache CXF version 4.2.4, 4.1.9, or 3.6.13 which fixes the race condition in the OAuth2 authorization code handling.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.