In the DefaultEncryptingCodeDataProvider component of Apache CXF, a flaw in the removeCodeGrant logic lets a captured authorization code be redeemed repeatedly, violating the RFC requirement that an authorization code must not be used more than once. This flaw can allow an attacker who has intercepted or otherwise obtained a valid authorization code to repeatedly request access tokens, effectively bypassing single‑use restrictions and potentially gaining unauthorized access to protected resources. The weakness is classified as CWE‑294 and CWE‑613, reflecting improper handling of authentication credentials.

Apache CXF from the Apache Software Foundation is affected for the specific releases identified: 4.2.3, 4.1.8, and 3.6.12. The CVE documentation recommends upgrading to these versions as they contain the fix. The data does not confirm whether other releases are impacted or not, so users should verify whether their environment uses the listed versions and apply the patch if necessary.

The vulnerability falls under CWE‑294 and CWE‑613, allowing unlimited replay of a captured authorization code, which may lead to unauthorized use of protected resources. No known public exploits have been reported, and the EPSS score of less than 1% indicates a low probability of exploitation. The CVSS score of 9.8 indicates critical severity. The likely attack vector is application‑level, requiring an attacker to intercept or otherwise obtain an authorization code through network interception or phishing and then replay it to obtain tokens. While HTTPS and monitoring for repeated code usage can mitigate the risk, the high severity and potential impact warrant proactive remediation.