GHSA-83r6-96m8-r52p: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing

Q: Which deployments are affected by this race condition?

Deployments using Apache CXF's AbstractOAuthDataProvider with recycleRefreshTokens set to false are affected. The issue concerns refresh-token processing where refresh tokens are intended to be single-use.

Q: What does an attacker need to exploit it?

An attacker needs a leaked or otherwise obtained refresh token and must replay it concurrently in multiple requests. No privileges or user interaction are required, but exploitation depends on winning a race between concurrent refresh-token requests.

Q: What is the impact of successful exploitation?

Concurrent reuse of one refresh token can produce multiple valid access tokens despite single-use refresh-token semantics. This can enable multiple attackers or threads holding the same leaked token to retain access through separately issued access tokens.

Q: What should teams do to remediate the issue?

Upgrade Apache CXF to version 4.2.2, 4.1.7, or 3.6.12. The provided information does not specify an alternative mitigation for environments that cannot immediately upgrade.

Published Jun 12, 2026

Updated

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or threads. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Affected Software

1 affected component

Apache CXF<4.2.2, <4.1.7, <3.6.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.2.2
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.1.7
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 3.6.12

Event History

Jun 12, 2026

CVE Published

via OSV·08:59 AM

Data Sourced

via OSV·08:59 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected by this race condition?

Deployments using Apache CXF's AbstractOAuthDataProvider with recycleRefreshTokens set to false are affected. The issue concerns refresh-token processing where refresh tokens are intended to be single-use.

What does an attacker need to exploit it?

An attacker needs a leaked or otherwise obtained refresh token and must replay it concurrently in multiple requests. No privileges or user interaction are required, but exploitation depends on winning a race between concurrent refresh-token requests.

What is the impact of successful exploitation?

Concurrent reuse of one refresh token can produce multiple valid access tokens despite single-use refresh-token semantics. This can enable multiple attackers or threads holding the same leaked token to retain access through separately issued access tokens.

What should teams do to remediate the issue?

Upgrade Apache CXF to version 4.2.2, 4.1.7, or 3.6.12. The provided information does not specify an alternative mitigation for environments that cannot immediately upgrade.

GHSA-83r6-96m8-r52p: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected by this race condition?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected by this race condition?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What should teams do to remediate the issue?