{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68079", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-07-30T09:22:10.738Z", "datePublished": "2026-08-06T11:22:57.938Z", "dateUpdated": "2026-08-07T00:01:53.998Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.cxf:cxf-rt-rs-security-oauth2", "product": "Apache CXF", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.2.3", "status": "affected", "version": "4.2.0", "versionType": "semver"}, {"lessThan": "4.1.8", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.12", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Guanping Zhang reported this vulnerability"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that \"The authorization code MUST NOT be used more than once.\" Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue."}], "value": "In Apache CXF's DefaultEncryptingCodeDataProvider,\u00a0a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the\u00a0removeCodeGrant functionality. This violates the RFC requirement that\u00a0\"The authorization code MUST NOT be used more than once.\" Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue."}], "metrics": [{"other": {"content": {"text": "low"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-294", "description": "CWE-294 Authentication Bypass by Capture-replay", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-06T11:22:57.938Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T15:16:22.015044Z", "id": "CVE-2026-68079", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T15:17:09.233Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/06/24"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-07T00:01:53.998Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/06/24"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-07T00:01:53.998Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-68079", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-06T15:16:22.015044Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T15:16:32.062Z"}}], "cna": {"title": "Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Guanping Zhang reported this vulnerability"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache CXF", "versions": [{"status": "affected", "version": "4.2.0", "lessThan": "4.2.3", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.1.8", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "3.6.12", "versionType": "semver"}], "packageName": "org.apache.cxf:cxf-rt-rs-security-oauth2", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In Apache CXF's DefaultEncryptingCodeDataProvider,\u00a0a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the\u00a0removeCodeGrant functionality. This violates the RFC requirement that\u00a0\"The authorization code MUST NOT be used more than once.\" Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.", "supportingMedia": [{"type": "text/html", "value": "In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that \"The authorization code MUST NOT be used more than once.\" Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-294", "description": "CWE-294 Authentication Bypass by Capture-replay"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-06T11:22:57.938Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68079", "state": "PUBLISHED", "dateUpdated": "2026-08-07T00:01:53.998Z", "dateReserved": "2026-07-30T09:22:10.738Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-08-06T11:22:57.938Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.cxf:cxf-rt-rs-security-oauth2", "product": "Apache CXF", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.2.3", "status": "affected", "version": "4.2.0", "versionType": "semver"}, {"lessThan": "4.1.8", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.12", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "[email protected]"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "matchCriteriaId": "09753EF1-BB56-4238-8ED7-609E2AB5EB05", "versionEndExcluding": "3.6.12", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "matchCriteriaId": "801F031C-B5F5-4CF5-B9A5-DD9AA2F76A66", "versionEndExcluding": "4.1.8", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "matchCriteriaId": "A112761E-E622-4AE5-9BE6-47A247021D4F", "versionEndExcluding": "4.2.3", "versionStartIncluding": "4.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Apache CXF's DefaultEncryptingCodeDataProvider,\u00a0a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the\u00a0removeCodeGrant functionality. This violates the RFC requirement that\u00a0\"The authorization code MUST NOT be used more than once.\" Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue."}], "id": "CVE-2026-68079", "lastModified": "2026-08-07T00:16:39.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68079", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T15:16:22.015044Z", "version": "2.0.3"}}]}, "published": "2026-08-06T12:16:28.060", "references": [{"source": "[email protected]", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/08/06/24"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-294"}], "source": "[email protected]", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.cxf/cxf: Apache CXF: Authorization code replay due to flaw in DefaultEncryptingCodeDataProvider", "id": "2511989", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511989"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-613", "details": ["In Apache CXF's DefaultEncryptingCodeDataProvider,\u00a0a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the\u00a0removeCodeGrant functionality. This violates the RFC requirement that\u00a0\"The authorization code MUST NOT be used more than once.\" Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.", "A flaw was found in Apache CXF's DefaultEncryptingCodeDataProvider. This vulnerability allows a remote attacker to redeem a captured authorization code an unlimited number of times. The flaw exists due to an issue in the `removeCodeGrant` functionality, which fails to properly invalidate used authorization codes. This can lead to unauthorized access or session hijacking, violating the security principle that authorization codes should only be used once."], "name": "CVE-2026-68079", "package_state": [{"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "cxf", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Out of support scope", "package_name": "cxf", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "cxf", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5", "fix_state": "Out of support scope", "package_name": "cxf", "product_name": "Red Hat JBoss Web Server 5"}], "public_date": "2026-08-06T11:22:57Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68079\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68079\nhttps://lists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.2.0,4.2.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.1.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.6.12)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache CXF", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "cxf", "vendor": "apache"}], "created": "2026-08-06T13:45:02.807757+00:00", "updated": "2026-08-12T11:30:03.780776+00:00", "vendors": ["apache", "apache$PRODUCT$cxf"]}