CVE-2026-68079 Details
Description
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
A vulnerability in Apache CXF's DefaultEncryptingCodeDataProvider allows a captured authorization code to be redeemed multiple times. This issue arises from a flaw in the implementation of the removeCodeGrant functionality, violating the RFC requirement that authorization codes must only be used once. The vulnerability affects Apache CXF versions 4.2.0 prior to 4.2.3, 4.0.0 prior to 4.1.8, and versions prior to 3.6.12.
Users are advised to upgrade to Apache CXF versions 4.2.3, 4.1.8, or 3.6.12.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/08/06/24 | CVE | |
| https://lists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-294 | Authentication Bypass by Capture-replay | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache cxf | < 3.6.12 >= 4.0.0, < 4.1.8 >= 4.2.0, < 4.2.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CVE |
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |