Description

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-06T12:16:27.373Z",
  "pubdate": "2026-08-06T12:16:27.373Z",
  "executiveSummary": "A race condition vulnerability exists within the JCacheCodeDataProvider component, allowing threat actors to bypass standard OAuth or authorization code lifecycle restrictions. The core issue stems from insufficient synchronization or atomic operations during the code redemption phase. This flaw enables an unauthenticated or low-privileged attacker to successfully redeem a single, legitimate authorization code multiple times by issuing concurrent requests to the authentication endpoint.\nThe primary impact of this security deficiency is the unauthorized generation of multiple distinct and fully valid access tokens from a single authorization code. This undermines token lifecycle management and violates core protocol constraints, which dictate that authorization codes must be strictly single-use. If exploited, an attacker can achieve session duplication, unauthorized resource access, or potential privilege escalation depending on the scopes associated with the compromised authorization code.\nAffected systems involve software utilizing vulnerable deployments of JCacheCodeDataProvider. Remediation requires immediate patching to the designated secure versions provided by the vendor. The vulnerability represents a significant risk to identity and access management (IAM) flows, requiring concurrent request handling defenses and transactional state validation within the authorization framework.",
  "technicalDetails": "The vulnerability resides in the JCacheCodeDataProvider component, specifically within the logic governing the consumption and invalidation of authorization codes. In a secure implementation, an authorization code must be marked as used or immediately invalidated in the underlying data store atomically upon the first redemption attempt. Any subsequent requests referencing the same authorization code must be rejected.\nDue to a race condition, the time-of-check to time-of-use (TOCTOU) window allows multiple concurrent threads or requests to check the validity of the authorization code simultaneously before the state is updated in the cache. Consequently, the data provider validates the code multiple times across overlapping execution threads, successfully issuing a unique, valid access token for each concurrent request.\nThe attack flow proceeds as follows: First, an attacker intercepts or legitimately acquires a single-use authorization code. Second, the attacker formulates a script or tool capable of firing multiple parallel HTTP requests containing the authorization code to the token endpoint. Third, because the backend state check and invalidation steps are not synchronized atomically, the JCacheCodeDataProvider processes each parallel request as valid. Fourth, the server returns multiple distinct access tokens to the attacker in the respective responses.\nAffected versions include all iterations prior to the patched releases. Users and administrators are strictly advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12, which contain the official vendor fixes addressing the synchronization flaw within the code provider logic."
}