Description

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-06T12:16:28.060Z",
  "pubdate": "2026-08-06T12:16:28.060Z",
  "executiveSummary": "This vulnerability involves an authorization code reuse flaw within Apache CXF, specifically residing in the DefaultEncryptingCodeDataProvider component.\nThe security deficiency stems from an improper implementation of the removeCodeGrant functionality, which fails to invalidate or correctly delete authorization codes upon their initial redemption.\nConsequently, an intercepted or captured authorization code can be successfully redeemed an unlimited number of times by an unauthorized actor, directly violating the core security requirements established by the OAuth 2.0 specification (RFC 6749), which mandates that authorization codes must be single-use only.\nThe primary impact of this flaw is unauthorized token acquisition, leading to potential session hijacking, unauthorized resource access, and compromise of user accounts relying on the affected OAuth 2.0 authorization server implementation.\nAffected systems include deployments of Apache CXF utilizing vulnerable versions.\nThe risk implication is critical for applications relying on strict authorization code lifecycle enforcement.\nAn attacker capable of sniffing or intercepting a legitimate authorization code in transit can replay the redemption request indefinitely to acquire valid access tokens.\nNo complex exploitation requirements are stated beyond the prerequisite capability of capturing an initial authorization code grant.",
  "technicalDetails": "The vulnerability is localized to the DefaultEncryptingCodeDataProvider class within Apache CXF, specifically within the execution flow of the removeCodeGrant functionality.\nThe root cause of the vulnerability is a logic defect where the internal state tracking or deletion mechanism fails to ensure that a consumed authorization code grant is permanently invalidated after its first successful exchange for an access token.\nUnder normal, secure OAuth 2.0 operations, an authorization code is designed to have a strict single-use constraint to prevent replay attacks.\nWhen a client presents an authorization code to the token endpoint, the authorization server must validate the code and immediately revoke it to prevent subsequent exchanges.\nIn the vulnerable Apache CXF implementation, the flaw in removeCodeGrant permits the same authorization code to persist or remain valid across multiple token redemption requests.\nThe attack flow proceeds as follows: First, an attacker intercepts a legitimate authorization code issued to a client, typically via network sniffing, compromised redirection parameters, or browser history analysis if transport security or leakage vectors permit.\nSecond, the attacker submits this captured authorization code to the token endpoint of the Apache CXF authorization server.\nThird, because the removeCodeGrant functionality fails to properly invalidate the code upon use, the server processes the request and successfully issues a valid access token to the attacker.\nFourth, the attacker can repeat this submission step an unlimited number of times, generating multiple valid access tokens using the exact same authorization code.\nThe vulnerable component is exposed over the network via the OAuth 2.0 token endpoint interfaces provided by Apache CXF.\nAuthentication requirements for the code redemption phase depend on the client type, but the core vulnerability is exploited via the reuse of the leaked authorization code itself.\nNo elevated privileges are required to exploit this flaw beyond possessing a valid, captured authorization code.\nThe post-exploitation impact includes prolonged unauthorized access to protected resources, potential impersonation of the victim user, and bypass of standard token lifecycle controls."
}