CVE-2026-50631: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing

Synopsis

A time-of-check to time-of-use (TOCTOU) race condition in Apache CXF's OAuth2 refresh token handling allows an attacker to replay a single refresh token concurrently and obtain multiple valid access tokens. The vulnerability is reachable over the network without any authentication, but requires winning a timing race between concurrent requests. Successful exploitation lets an attacker read protected resources and tamper with data accessible via the fraudulently issued access tokens. Patched-image rebuilds at versions 4.1.7 and 4.2.2 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The OAuth2 token endpoint must be reachable over the network; an attacker sends concurrent HTTP requests to the refresh token endpoint from a remote host.

• AuthenticationNot required

  No account or credential is needed beyond possession of a leaked or stolen refresh token, which is the precondition the attacker supplies directly.

• Victim interactionNot required

  The attack is fully automated via concurrent requests; no user action or social engineering is involved.

• Attack complexityDetail

  Attack complexity is high because the exploit depends on winning a narrow timing window between concurrent requests, requiring precise coordination or tooling to reliably trigger the race.

Blast Radius

• An attacker obtains multiple valid access tokens from a single refresh token, extending unauthorized session lifetime beyond what the server intends to permit.
• Using the fraudulently issued access tokens, the attacker reads protected API resources and stored data accessible to the legitimate token holder.
• The attacker can modify or write data through API calls authorized by the extra access tokens, affecting any resource the original token scope covers.