CVE-2026-68079
Description
A flaw was found in Apache CXF's DefaultEncryptingCodeDataProvider. This vulnerability allows a remote attacker to redeem a captured authorization code an unlimited number of times. The flaw exists due to an issue in the removeCodeGrant functionality, which fails to properly invalidate used authorization codes. This can lead to unauthorized access or session hijacking, violating the security principle that authorization codes should only be used once.
Statement
A flaw was found in Apache CXF's DefaultEncryptingCodeDataProvider, which Red Hat products ship through the cxf-rt-rs-security-oauth2 component. A bug in the removeCodeGrant functionality prevents authorization codes from being properly invalidated after use, so a remote attacker who captures a valid authorization code can redeem it an unlimited number of times, violating the requirement that an authorization code be used only once. Successful replay of a captured code can lead to unauthorized access or session hijacking. Red Hat rates this flaw as moderate severity because exploitation requires an attacker to first capture a valid, unexpired authorization code and the direct impact is limited to confidentiality (RH CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). This differs from the CISA score of 9.8, which assumes full confidentiality, integrity, and availability impact without accounting for the prerequisite of capturing a code. The Red Hat build of Apache Camel 4 is affected and a fix is being pursued through the delegated resolution; Red Hat JBoss Web Server 5 is also affected, but that stream is out of support scope.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | None | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
