Apache CXF up to 3.6.11/4.1.7/4.2.2 authentication replay

Summaryinfo

A vulnerability marked as critical has been reported in Apache CXF up to 3.6.11/4.1.7/4.2.2. Affected by this vulnerability is an unknown functionality. This manipulation causes authentication replay. This vulnerability is handled as CVE-2026-68079. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in Apache CXF up to 3.6.11/4.1.7/4.2.2. Affected by this vulnerability is an unknown code. The manipulation with an unknown input leads to a authentication replay vulnerability. The CWE definition for the vulnerability is CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

It is possible to read the advisory at lists.apache.org. This vulnerability is known as CVE-2026-68079 since 07/30/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/06/2026). The attack technique deployed by this issue is T1040 according to MITRE ATT&CK.

Upgrading to version 3.6.12, 4.1.8 or 4.2.3 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• CXF

Version

• 3.6.0
• 3.6.1
• 3.6.2
• 3.6.3
• 3.6.4
• 3.6.5
• 3.6.6
• 3.6.7
• 3.6.8
• 3.6.9
• 3.6.10
• 3.6.11
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.2.0
• 4.2.1
• 4.2.2

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion