CVE-2026-50631

CVE-2026-50631

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh t…

Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)

Weakness classification (CWE)

References