Vulnerability in Apache Cxf
CVE-2026-68079
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
EPSS: 0.004 (33.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Cxf
- Apache Software Foundation Cxf — versions 4.2.0, 4.0.0, 0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2026-68079?
- CVE-2026-68079 is a critical-severity vulnerability in Apache Cxf, classified under Authentication Bypass by Capture-replay. CVSS score: 9.8/10. Published 2026-08-06.
- How severe is CVE-2026-68079?
- Critical severity. CVSS v3 base score is 9.8 out of 10.