A race condition vulnerability in Apache CXF allows unauthenticated attackers to bypass authorization controls, potentially leading to unauthorized token generation and session hijacking.

This is a Time-of-check Time-of-use (TOCTOU) race condition (CWE-367) found in the JCacheCodeDataProvider. The vulnerability is exploitable by an unauthenticated remote attacker who can send concurrent requests to redeem authorization codes multiple times.

Successful exploitation allows an attacker to generate multiple valid access tokens from a single authorization code, effectively bypassing authentication and authorization mechanisms. With a CVSS score of 8.1, this flaw poses a severe risk to service integrity and user account security, potentially leading to widespread unauthorized access to protected resources.

Immediate Action: Update to the latest version of Apache CXF as defined in the vendor security advisory to resolve the race condition.

Proactive Monitoring: Monitor authentication logs for suspicious patterns of multiple access token requests occurring in rapid succession for the same user or authorization code.

Compensating Controls: Deploy a Web Application Firewall (WAF) to throttle or block rapid, concurrent requests to the authorization endpoint, which may mitigate the race condition during the patching window.

Public Exploit Available: Unknown

The ability to generate unauthorized access tokens is a critical security failure for any application relying on Apache CXF for OAuth or similar flows. Security teams must ensure that the application is updated to the fixed version immediately to restore the integrity of the authorization process.