CVE-2026-50631: Apache CXF race condition in AbstractOAuthDataProvider

CVE-2026-50631 · Severity: high · CVSS 7.4 · Published 2026-06-12

Apache CXF is a widely-used framework for building web services and OAuth2-protected APIs. A timing flaw in its token handling allows attackers who obtain a single refresh token to generate multiple valid access tokens by making concurrent requests. This could enable account takeover or unauthorized data access if a refresh token is leaked or compromised. The issue only occurs when token recycling is disabled in the configuration.

Technologies: Apache Software Foundation CXF, org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-50631 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50631 being exploited in the wild.
How severe is CVE-2026-50631?
High severity, with a CVSS score of 7.4, published 12 June 2026.
Which products and versions are affected?
Apache Software Foundation CXF 4.2.0 to 4.2.1, all versions before 4.1.7; org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven) ECOSYSTEM:introduced=4.2.0,fixed=4.2.2.
Is there a fix for CVE-2026-50631?
Yes. org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven): upgrade to 4.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50631 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50631?
Check whether you run Apache Software Foundation CXF or org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven): upgrade to 4.2.2 or later
    # set org.apache.cxf:cxf-rt-rs-security-oauth2 to 4.2.2 in your pom.xml or build.gradle

Technical details

The vulnerability is a time-of-check-time-of-use (TOCTOU) race condition in AbstractOAuthDataProvider's refresh token validation logic. When recycleRefreshTokens is set to false, the component checks token validity before consuming it, but concurrent requests can bypass this check and each generates a new access token from the same refresh token. An attacker with network access (no authentication required) can exploit this by issuing multiple simultaneous HTTP requests with an intercepted refresh token, bypassing the intended single-use semantics. This allows generation of multiple valid access tokens for the same identity, leading to unauthorized API access and potential data exposure. The fix in versions 4.2.2 and 4.1.7 implements proper locking to serialize token consumption.

Affected products

  • Apache CXF 4.2.0 before 4.2.2, and before 4.1.7

Identifiers

  • CVE-2026-50631
  • GHSA-83r6-96m8-r52p

Timeline

  • 2026-06-12: disclosed: Published to GitHub Advisory Database and NVD
  • 2026-06-12: patched: Patches released: CXF 4.2.2 and 4.1.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.