A race condition exists in the JCacheCodeDataProvider component of Apache CXF that allows an attacker to redeem a single OAuth2 authorization code more than once by sending concurrent requests. The flaw results in the issuance of multiple distinct, valid access tokens from a single authorization attempt. This allows the attacker to obtain additional privileged access that should have been granted only once, potentially escalating privileges and compromising confidentiality and integrity of protected resources. The vulnerability is a classic time‑of‑check/time‑of‑use (TOCTOU) bug, identified as CWE‑367.

Apache CXF is the affected product. Versions older than 4.2.3, 4.1.8, and 3.6.12 contain the vulnerability, while those specific patched releases have been issued to fix it. Any deployment using the vulnerable JCacheCodeDataProvider implementation is at risk, regardless of the environment in which Apache CXF is operating.

The CVSS score is 8.1, and EPSS data is unavailable, but the flaw permits an attacker with the ability to send simultaneous OAuth2 token requests to exploit the race condition. Because the vulnerability provides a straightforward privilege‑escalation path by generating multiple access tokens, the risk to impacted systems is substantial. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet become a high‑profile exploit target, though its existence and availability of an unpatched code path mean that interest from malicious actors is likely. The likely attack vector involves initiating authorized requests to the OAuth2 token endpoint that uses the vulnerable JCacheCodeDataProvider implementation.