Vulnerabilities CVE-2026-50629

CVE-2026-50629

None

Open

TLP:CLEAR

Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Details

EPSS Score ⓘ: 0.47%

38.5th percentile
Confidence: 90%
Published: Jun 12, 2026
Last Modified: Aug 7, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.