# CVE-2026-73179: Apache CXF race condition in OAuth2 authorization code grant

Source: https://junglewise.ai/threats/cve-2026-73179-improper-enforcement-of-single-use-authorization-code-semantics  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-73179 · Severity: high · CVSS 8.1 · Published 2026-10-09

Apache CXF is a popular framework that handles OAuth2 authentication, which is used to securely grant access to protected resources. A flaw in the JPA OAuth2 authorization code grant provider allows attackers to obtain multiple access tokens from a single authorization code by sending concurrent token exchange requests that exploit a race condition. This could allow an attacker to gain unauthorized access to user accounts and resources.

Technologies: [Apache CXF](https://junglewise.ai/threats/technologies/apache-cxf). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-73179 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73179 being exploited in the wild.

**How severe is CVE-2026-73179?** High severity, with a CVSS score of 8.1, published 9 October 2026.

**Which products and versions are affected?** Apache CXF before 3.6.13, 4.1.x before 4.1.9, 4.2.x before 4.2.4.

**Is there a fix for CVE-2026-73179?** Yes: fixed in CXF 3.6.13, 4.1.9, 4.2.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73179 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-73179?** Check whether you run Apache CXF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in CXF 3.6.13, 4.1.9, 4.2.4

## Technical details

The vulnerability is a race condition in the non-atomic find-then-delete operation of the JPA OAuth2 authorization code grant provider that fails to enforce single-use semantics of authorization codes. Under READ_COMMITTED database isolation, concurrent token exchange requests can both read the same authorization code before either deletes it, resulting in multiple valid access tokens being issued. An attacker with network access can exploit this without authentication by timing concurrent requests to the token endpoint.

## Affected products

- Apache CXF before 3.6.13, 4.1.x before 4.1.9, 4.2.x before 4.2.4

## Timeline

- 2026-10-09: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/6msbm601o6ogfgdzdbtbrmgspmz50nxk](https://lists.apache.org/thread.html/6msbm601o6ogfgdzdbtbrmgspmz50nxk)

## Related threats

- [Apache CXF hash collision bypass in STS token validation](https://junglewise.ai/threats/cve-2026-97468-apache-cxf-s-ststokenvalidator-and-security-token-service-sts)
- [Apache CXF FIQL query parser ReDoS in operator search](https://junglewise.ai/threats/cve-2026-86463-apache-cxf-s-fiql-query-parser-has-a-vulnerability-in-how-it)
- [Apache CXF OIDC relying-party open redirect after authentication](https://junglewise.ai/threats/cve-2026-79650-apache-cxf-s-oidc-relying-party-component-could-redirect-users-to)
- [Apache CXF CompressionUtils.inflate() zip bomb](https://junglewise.ai/threats/cve-2026-78384-compressionutils-inflate-decompressed-attacker-controlled-deflate)
- [Apache CXF StaxUtils XML denial of service](https://junglewise.ai/threats/cve-2026-108039-by-default-staxutils-placed-no-limit-on-the-total-number-of)