Paper/Archive/CVE-2026-68079

CVE-2026-68079

Apache Software Foundation Apache CXF — Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay

EPSS 0.7%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 52.5.525 × 2010.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Affected

ProductAffectedFixed inSource

Apache CXF4.2.0 – < 4.2.34.2.3CNA

Apache CXF4.0.0 – < 4.1.84.1.8CNA

Apache CXF< 3.6.123.6.12CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o refopenwall.com/lists/oss-security/2026/08/06/24