In the DefaultEncryptingCodeDataProvider component of Apache CXF, a flaw in the removeCodeGrant logic lets a captured authorization code be redeemed repeatedly, violating the RFC requirement that an authorization code must not be used more than once. This flaw can allow an attacker who has intercepted or otherwise obtained a valid authorization code to repeatedly request access tokens, effectively bypassing single-use restrictions and potentially gaining unauthorized access to protected resources. The weakness is classified as CWE‑294, reflecting improper handling of authentication credentials.

Apache CXF is the affected product from the Apache Software Foundation. Versions prior to 4.2.3 in the 4.x line, 4.1.8 in the 4.1.x line, and 3.6.12 in the 3.6.x line contain the flaw and must be upgraded to a patched release; all other versions remain unaffected. Users should verify the installed version and apply the mentioned patch to eliminate the replay vulnerability.

The vulnerability allows unlimited replay of a captured authorization code, leading to a high impact if an attacker can intercept OAuth flows, though no public exploitation data is currently available and the EPSS score is not reported. The attack vector is likely application-level; an adversary would need to capture an authorization code through network interception or phishing, then replay it to obtain tokens. The CVSS score is 9.8, indicating a critical severity. Secure transport (HTTPS) and monitoring the reuse of codes can reduce exploitability, but the absence of a publicly known exploit suggests current risk is moderate until proven otherwise.