Beveiligingsadvies

CVE-2026-50631

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-06-12 08:59:40

Laatst bijgewerkt 2026-08-07 12:43:22

Toegewezen door apache

CVSS-score 7.4

Status PUBLISHED

Beschrijving

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or threads. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

← Alle CVE's bekijken Bekijk op cve.org ↗