CVE-2026-73179

Katalog CVE

CVSS 8.1 · High EPSS 0,22%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition. Skor CVSS 3.1 8.1 (High) menurut CISA ADP.

Deskripsi (NVD)

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-then-delete operation against a shared relational database under READ_COMMITTED isolation. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fixes this issue.

Rincian

Terbit di NVD

9 Oktober 2026

Terakhir diubah

15 Oktober 2026

Status NVD

Undergoing Analysis

CVSS 3.1

8.1 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://lists.apache.org/thread.html/6msbm601o6ogfgdzdbtbrmgspmz50nxk
• http://www.openwall.com/lists/oss-security/2026/10/09/5