CVE-2026-68079

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.3 Apache CXF versions prior to 4.1.8 Apache CXF versions prior to 3.6.12

Description A flaw in the implementation of the removeCodeGrant() function within the DefaultEncryptingCodeDataProvider allows a captured authorization code to be redeemed an unlimited number of times. This behavior contradicts the RFC requirement that an authorization code must not be used more than once.

Recommendations Upgrade to version 4.2.3. Upgrade to version 4.1.8. Upgrade to version 3.6.12.