Race Condition Vulnerability in JCacheCodeDataProvider Affects Apache Software
CVE-2026-57818

8.1HIGH

Key Information:

Vendor

Apache
Status
Apache Cxf
Vendor
CVE Published:
6 August 2026

What is CVE-2026-57818?

A race condition vulnerability in JCacheCodeDataProvider allows an attacker to exploit the authorization code flow by sending concurrent requests. This leads to the potential redemption of a single authorization code multiple times, resulting in the issuance of several valid access tokens for the same authorization session. This mismanagement can compromise user security and potentially expose sensitive information. Users are advised to upgrade to the patched versions (4.2.3, 4.1.8, or 3.6.12) to mitigate this issue.

Affected Version(s)

Apache CXF 4.2.0 < 4.2.3

Apache CXF 4.0.0 < 4.1.8

Apache CXF 0 < 3.6.12

References

https://lists.apache.org/thread/7q08mz8bcbosp25wok7gr537z...
vendor-advisory

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Guanping Zhang reported this vulnerability
.