CVE-2026-50629: Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier
The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.2.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.6.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50629?
The severity of CVE-2026-50629 is medium with a CVSS score of 5.3.
How can I fix CVE-2026-50629?
To mitigate CVE-2026-50629, users are recommended to upgrade to the latest version of Apache CXF.
What type of vulnerability is CVE-2026-50629?
CVE-2026-50629 is a CRLF Injection vulnerability due to unsanitized input in the clientId parameter.
What impact does CVE-2026-50629 have on security?
CVE-2026-50629 allows attackers to inject arbitrary content into server log files, potentially leading to fake log entries.
In which software is CVE-2026-50629 found?
CVE-2026-50629 is found in Apache CXF.