A race condition in Apache CXF's AbstractOAuthDataProvider permits concurrent requests to reuse the same refresh token when the recycleRefreshTokens flag is false, bypassing the intended single-use semantics. The flaw allows a leaked refresh token to be replayed by multiple attackers or threads, producing several valid access tokens from a single credential. This enables token replay attacks and can grant broader authorization than intended. Users are advised to upgrade to versions 4.2.2, 4.1.7, or 3.6.12 to resolve the issue.

The vulnerability applies to versions of Apache CXF released before the public fix versions. Apache CXF users should upgrade to at least 4.2.2 or 4.1.7, the releases that contain a patch for this race condition. Versions running on older releases with recycleRefreshTokens disabled remain susceptible.

The race condition exists in Apache CXF's AbstractOAuthDataProvider and can be triggered when recycleRefreshTokens is disabled. Once a refresh token is leaked or observed, an attacker can send concurrent requests that reuse the same token, resulting in multiple valid access tokens. The CVSS score of 7.4 reflects a high severity, but the EPSS score of <1% indicates a low likelihood of exploitation. Although not listed in KEV, the flaw could allow widespread unauthorized access. Generated tokens can be used to access protected resources until revoked or expired.