GHSA-83r6-96m8-r52p
Suggest an improvement- Source
- https://github.com/advisories/GHSA-83r6-96m8-r52p
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-83r6-96m8-r52p/GHSA-83r6-96m8-r52p.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-83r6-96m8-r52p
- Aliases
- Published
- 2026-06-12T12:31:33Z
- Modified
- 2026-08-20T18:48:08Z
- Severity
-
- 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing
- Details
-
A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or threads. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
- Database specific
{ "cwe_ids": [ "CWE-367" ], "github_reviewed": true, "github_reviewed_at": "2026-08-20T18:32:34Z", "nvd_published_at": "2026-06-12T10:16:23Z", "severity": "HIGH" }- References
Affected packages
Maven / org.apache.cxf:cxf-rt-rs-security-oauth2
Package
- Name
- org.apache.cxf:cxf-rt-rs-security-oauth2
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2
Maven / org.apache.cxf:cxf-rt-rs-security-oauth2
Package
- Name
- org.apache.cxf:cxf-rt-rs-security-oauth2
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed4.1.7
Affected versions
2.*
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.6.10
2.6.11
2.6.12
2.6.13
2.6.14
2.6.15
2.6.16
2.6.17
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.7.10
2.7.11
2.7.12
2.7.13
2.7.14
2.7.15
2.7.16
2.7.17
2.7.18
3.*
3.0.0-milestone1
3.0.0-milestone2
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.3.10
3.3.11
3.3.12
3.3.13
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.4.10
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.5.10
3.5.11
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
3.6.10
3.6.11
3.6.12
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.0.11
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6