CVE-2026-50631: Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing

June 12, 2026 (updated August 20, 2026)

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when ‘recycleRefreshTokens’ is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or threads. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

References

github.com/advisories/GHSA-83r6-96m8-r52p
lists.apache.org/thread/s83t3x4r626o9h8rt0ryr1w7w53l1vv8
nvd.nist.gov/vuln/detail/CVE-2026-50631

Code Behaviors & Features

Detect and mitigate CVE-2026-50631 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →