CyberRota Analysis
This is a high severity vulnerability with a CVSS score of 7.4. See the original NVD description below for full technical details.
CVE
CVE-2026-50631
Severity
HIGH
CVSS
7.4
EPSS
0.29%
Original NVD Description
A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or threads. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)