RHLW-2026-2d8697b26ccd16c3

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-2d8697b26ccd16c3.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-2d8697b26ccd16c3.json
JSON Data
https://api.test.osv.dev/v1/vulns/RHLW-2026-2d8697b26ccd16c3
Upstream
CVE (4)
Published
2026-10-13T21:10:22Z
Modified
2026-10-20T23:00:05Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Lightwell Security Advisory: cxf-rt-rs-security-oauth2 4.2.2.rhlw-00006
Details

Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 4.2.2.rhlw-00006 with backported fixes for CVE-2026-57818, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481.

CVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider

CVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters

CVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay

CVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider

This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-oauth2 4.2.2 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages