CLEANSTART-2026-PD43830: Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from...
Security vulnerability affects the wso2am package. Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-th....
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/wso2amto a version that resolves this vulnerability.Fixed in 4.7.0-r4
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs a valid authorization code and must submit concurrent token exchange requests to race the non-atomic authorization-code lookup. No authenticated or privileged account is required according to the provided vector.
Which deployments are exposed?
The affected software is identified as cleanstart/wso2am. The issue is in the JPA OAuth2 authorization code grant provider, so exposure depends on use of that authorization-code token exchange path.