A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or threads. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/s83t3x4r626o9h8rt0ryr1w7w53l1vv8 | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/06/11/8 | Mailing List Third Party Advisory |
Configurations
History
12 Jun 2026, 19:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.apache.org/thread/s83t3x4r626o9h8rt0ryr1w7w53l1vv8 - Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/06/11/8 - Mailing List, Third Party Advisory | |
| First Time |
Apache cxf
Apache |
|
| CPE | cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* |
12 Jun 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.4 |
12 Jun 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-12 10:16
Updated : 2026-06-12 19:03
NVD link : CVE-2026-50631
Mitre link : CVE-2026-50631
CVE.ORG link : CVE-2026-50631
JSON object : View
Products Affected
apache
- cxf
CWE
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition