CVE-2026-68079

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-68079
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68079.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68079
Published
2026-08-06T11:22:57.938Z
Modified
2026-08-08T03:47:58.710242239Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
Details

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-294"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68079.json",
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "4.2.0"
                },
                {
                    "fixed": "4.2.3"
                },
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "4.1.8"
                },
                {
                    "fixed": "3.6.12"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/cxf

Affected ranges

Type
GIT
Repo
https://github.com/apache/cxf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
16d606b3c4d5c7d271fd3b488c60a208586acb3f
Introduced
02310e95fe74c0c031f540f3284e4a9bd856ced2
Fixed
8797a177ec23e9c578c78a630c154ad27d9bbe8d
Introduced
04ccbfd709eef8f4af53d6237514fbe9db7ea81f
Fixed
33259395b45b4ff69b8df6a153630721fdd489fa
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.6.12"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.1.8"
        },
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.2.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

cxf-2.*
cxf-2.1
cxf-2.1.2
cxf-2.2
cxf-2.2.1
cxf-2.2.2
cxf-2.3.0
cxf-2.4.0
cxf-2.5.0
cxf-2.5.1
cxf-2.6.0
cxf-2.6.1
cxf-2.7.0
cxf-2.7.1
cxf-2.7.2
cxf-3.*
cxf-3.0.0
cxf-3.0.0-milestone2
cxf-3.1.0
cxf-3.1.1
cxf-3.1.2
cxf-3.1.3
cxf-3.1.4
cxf-3.2.0
cxf-3.2.1
cxf-3.2.2
cxf-3.2.3
cxf-3.2.4
cxf-3.2.5
cxf-3.3.0
cxf-3.3.1
cxf-3.3.2
cxf-3.3.3
cxf-3.4.0
cxf-3.4.1
cxf-3.5.0
cxf-3.6.0
cxf-3.6.1
cxf-3.6.10
cxf-3.6.11
cxf-3.6.2
cxf-3.6.3
cxf-3.6.4
cxf-3.6.5
cxf-3.6.6
cxf-3.6.7
cxf-3.6.8
cxf-3.6.9
cxf-4.*
cxf-4.0.0
cxf-4.0.1
cxf-4.0.2
cxf-4.0.3
cxf-4.0.4
cxf-4.1.0
cxf-4.1.1
cxf-4.1.2
cxf-4.1.3
cxf-4.1.4
cxf-4.1.5
cxf-4.1.6
cxf-4.1.7
cxf-4.2.0
cxf-4.2.1
cxf-4.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68079.json"