CVE-2026-57818
High · 8.1CVSS
8.1
EPSS
0.5%
Published
Aug 6, 2026
CISA due date
—
The record
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121245 Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-367
- CVE-2026-121050 Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a… CWE-367
- CVE-2026-121048 Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to… CWE-367
- CVE-2026-88968 Claude Code is an agentic coding tool. CWE-367
- CVE-2026-119977 WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. CWE-367
- CVE-2026-116250 In server mode pgAdmin 4 validates a path a user gives for a file in their storage… CWE-367
- CVE-2026-116240 In server mode pgAdmin 4 validates a path into the user's storage directory with… CWE-367
- CVE-2026-115683 A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate… CWE-367