CVE catalog

CVE-2026-50631

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshToke

[CVE catalog]

Severity
High · CVSS 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.29% · Oct 25, 2026

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or threads. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpecxfNot reported4.1.7fixed
CpecxfNot reported4.2.2fixed
Mavenorg.apache.cxf:cxf-rt-rs-security-oauth2Not reported4.1.7fixed
CpecxfNot reported4.2.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpecxfcpeNot reported4.1.7Not reportedNot reportedNot reported
CpecxfcpeNot reported4.2.2Not reportedNot reportedNot reported
Mavenorg.apache.cxf:cxf-rt-rs-security-oauth2mavenNot reported4.1.7Not reportedGHSA-83R6-96M8-R52PNot reported
CpecxfcpeNot reported4.2.2Not reportedNVD-CVE-2026-50631Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)]