CVE-2026-68079

criticalCVSS 9.8covered by 1 sourcefirst seen 2026-08-06

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

⚡ Watch CVE-2026-68079

Get an email if CVE-2026-68079 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

criticalCVE-2026-68079: In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeem…nvd · 2026-08-06

External references

NVD record for CVE-2026-68079

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-68079 status](https://www.csirts.com/badge/CVE-2026-68079)](https://www.csirts.com/cve/CVE-2026-68079)