CVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.3 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.8 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.6.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68079?
CVE-2026-68079 has a risk score of 62, indicating a significant security vulnerability.
How do I fix CVE-2026-68079?
To mitigate CVE-2026-68079, ensure you update to the latest version of Apache CXF where the authorization code replay flaw has been addressed.
What systems are affected by CVE-2026-68079?
CVE-2026-68079 affects systems utilizing the DefaultEncryptingCodeDataProvider in Apache CXF.
What type of vulnerability is CVE-2026-68079?
CVE-2026-68079 is an authorization code replay vulnerability affecting the implementation of the removeCodeGrant functionality in Apache CXF.
What potential impact does CVE-2026-68079 have?
CVE-2026-68079 allows attackers to redeem an authorization code multiple times, which can lead to unauthorized access and security breaches.