CVE-2026-50629
Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier
MEDIUM 5.3
At a glance
- Source
- NVD
- EPSS
- EPSS 0.44 % · percentile 38 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Modified
Description
The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Weaknesses (CWE)
- CWE-93 — Improper Neutralization of CRLF Sequences
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- GHSA-f8p7-h97q-7vx7 — Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier
European references
- ENISA EUVD · EUVD-2026-36397
- GCVE · GCVE-0-2026-50629
Affected configurations (NVD CPE)
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*< 4.1.7cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*≥ 4.2.0 < 4.2.2
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache CXF | affected 4.2.0 < 4.2.2 ; affected 4.0.0 < 4.1.7 ; affected 0 < 3.6.12 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |