CyberRota Analysis
AI-GeneratedThe vulnerability affects the JPA OAuth2 authorization code grant provider in Apache CXF, allowing remote attackers to exploit improper enforcement of single-use authorization code semantics. This flaw enables attackers to obtain multiple valid access tokens from a single authorization code through concurrent token exchange requests, potentially compromising user accounts. Organizations using affected versions of Exchange or Apache CXF should prioritize upgrading to the recommended secure versions to mitigate this risk.
Original NVD Description
Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-then-delete operation against a shared relational database under READ_COMMITTED isolation. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fixes this issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)