GitHub Advisoryadvisory · Maven

GHSA-f8p7-h97q-7vx7 Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier

HIGH Published 2026-06-12 Modified 2026-08-20 Official page ↗
Aliases
CVE-2026-50629
Ecosystem
Maven
Packages
org.apache.cxf:cxf-rt-rs-security-oauth2
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-93
Reviewed
2026-08-20

Affected packages

• Maven org.apache.cxf:cxf-rt-rs-security-oauth2: >= 4.2.0, < 4.2.2 → fixed in 4.2.2 • Maven org.apache.cxf:cxf-rt-rs-security-oauth2: < 4.1.7 → fixed in 4.1.7

Description

The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2026-50629 The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing… vulnerability

Weakness · CWE (1)

  • CWE-93 Improper Neutralization of CRLF Sequences weakness

References