Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or threads. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-50631 A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Acces… https://www.cve.org/CVERecord?id=CVE-2026-50631
Post summary
This entry describes a race condition in AbstractOAuthDataProvider that lets attackers reuse a Refresh Token to generate multiple valid Access tokens, with a reference to the CVE-2026-50631 record.
CVE-2026-50631 Race Condition in AbstractOAuthDataProvider Allows Multiple Access Token... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-50631 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The message announces CVE‑2026‑50631, describing a race condition in AbstractOAuthDataProvider that permits multiple access tokens, but offers no PoC, exploit, patch, or active exploitation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | cxf | - | - | - |