A critical authentication bypass in Apache CXF allows for the replay of authorization codes, potentially leading to unauthorized account access.

This is an authentication bypass vulnerability (CWE-294) caused by a failure to properly invalidate authorization codes after use. An unauthenticated attacker can capture and replay these codes to gain unauthorized access to protected resources.

By enabling the reuse of authorization codes, this vulnerability undermines the entire authentication framework of the affected application. With a CVSS score of 9.8, this flaw could allow attackers to hijack legitimate user sessions, leading to unauthorized access to sensitive business data and administrative functions.

Immediate Action: Upgrade Apache CXF to version 4.2.3, 4.1.8, or 3.6.12 to correctly implement the one-time use requirement for authorization codes.

Proactive Monitoring: Monitor authentication logs for multiple successful redemptions of the same authorization code grant, which may indicate active exploitation.

Compensating Controls: Use a WAF to detect and block suspicious replay attempts or anomalous repeated requests to authorization endpoints.

Public Exploit Available: Unknown

Organizations must treat this authentication bypass with the highest level of urgency. Applying the vendor-supplied patches is the only effective way to ensure that authorization codes cannot be replayed, effectively closing the window for unauthorized session access.