Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-68079 Authorization Code Reuse Vulnerability in Apache CXF DefaultEncryptingCodeDataProvider https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-68079
Post summary
CVE‑2026‑68079 is an authorization code reuse flaw in Apache CXF’s DefaultEncryptingCodeDataProvider, as noted on Vulmon.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | cxf | - | - | - |