CVE-2026-57818

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.

• CWE-367

• https://lists.apache.org/thread/7q08mz8bcbosp25wok7gr537zlp15mfzMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/08/06/20

Published

Aug 6, 2026

Last Modified

Aug 7, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57812Missing Authorization vulnerability in NSquared Simply Sched…6.5
• CVE-2026-57813Incorrect Privilege Assignment vulnerability in properfracti…9.8
• CVE-2026-57814Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-57815Improper Limitation of a Pathname to a Restricted Directory …7.5
• CVE-2026-57816Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-57817The OpenID Connect Core 1.0 specification mandates that the …8.1
• CVE-2026-57819Apache CXF allows to set a limit on the number of form param…7.5
• CVE-2026-57821A SQL Injection vulnerability exists in Apache Fineract's Of…8.1
• CVE-2026-57827Joomla Extension - rsjoomla.com - Unauthenticated file uploa…9.8
• CVE-2026-57828Joomla Extension - phoca.cz - Authenticated file upload in R…8.8
• CVE-2026-57829Joomla Extension - joomshaper.com - Unauthenticated stored X…6.1
• CVE-2026-5783Improper neutralization of input during web page generation …7.6