Race Condition Vulnerability in JCacheCodeDataProvider Affects Apache Software

CVE-2026-57818

What is CVE-2026-57818?

A race condition vulnerability in JCacheCodeDataProvider allows an attacker to exploit the authorization code flow by sending concurrent requests. This leads to the potential redemption of a single authorization code multiple times, resulting in the issuance of several valid access tokens for the same authorization session. This mismanagement can compromise user security and potentially expose sensitive information. Users are advised to upgrade to the patched versions (4.2.3, 4.1.8, or 3.6.12) to mitigate this issue.

References