CLEANSTART-2026-BE59467: Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from...

Q: Does exploitation require an authenticated user or user interaction?

No privileges and no user interaction are required according to the supplied vector. The attack is network-accessible, but has high attack complexity because it depends on concurrent token exchange requests winning a race condition.

Q: What access is needed to trigger the issue?

The attacker needs a single authorization code and must submit concurrent token exchange requests using that code. Successful exploitation can result in multiple valid access tokens being issued from that one code.

Q: Which deployments should be prioritized for review?

Review deployments of the listed cleanstart/wso2am software that use the JPA OAuth2 authorization code grant provider. The provided data does not identify affected versions, fixed versions, or a configuration-based workaround.

Published Nov 11, 2026

Updated

Security vulnerability affects the wso2am package. Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-th....

Affected Software

1 affected componentFixes available

cleanstart/wso2am<4.7.0-r5

4.7.0-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/wso2am to a version that resolves this vulnerability.
Fixed in 4.7.0-r5

Event History

Nov 11, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-73179

Frequently Asked Questions

Does exploitation require an authenticated user or user interaction?

No privileges and no user interaction are required according to the supplied vector. The attack is network-accessible, but has high attack complexity because it depends on concurrent token exchange requests winning a race condition.

What access is needed to trigger the issue?

The attacker needs a single authorization code and must submit concurrent token exchange requests using that code. Successful exploitation can result in multiple valid access tokens being issued from that one code.

Which deployments should be prioritized for review?

Review deployments of the listed cleanstart/wso2am software that use the JPA OAuth2 authorization code grant provider. The provided data does not identify affected versions, fixed versions, or a configuration-based workaround.

CLEANSTART-2026-BE59467: Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does exploitation require an authenticated user or user interaction?

What access is needed to trigger the issue?

Which deployments should be prioritized for review?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an authenticated user or user interaction?

What access is needed to trigger the issue?

Which deployments should be prioritized for review?