Executive brief
Apache CXF is a popular open-source framework for building web services, including OAuth2 authentication support. An attacker can send a crafted HTTP request with special characters in the client identifier field, which gets logged without sanitization, allowing them to inject fake log entries or hide real security events. This could be used to cover tracks after a breach or manipulate log-based security monitoring.
Technical details
This is a CRLF injection vulnerability (CWE-93) in the OAuth2 server logging code. The vulnerable component directly concatenates the 'clientId' query parameter from incoming HTTP requests into log warning messages without neutralizing control characters such as carriage return (\r) and line feed (\n). An attacker can exploit this via a network request to the OAuth2 endpoint by crafting a malicious clientId parameter (e.g., `clientId=attacker%0Ainjected_log_entry`) to inject arbitrary content into server logs. No authentication is required, attack complexity is low, and the attack surface is the publicly exposed OAuth2 endpoint. An attacker can achieve high confidentiality impact (log tampering exposes sensitivity) and low integrity impact (fake log entries). Patches are available in Apache CXF 4.2.2 and 4.1.7.
Affected products
- Apache CXF 4.2.0 to 4.2.1, < 4.1.7
Timeline
- 2026-06-11: disclosed: Vulnerability disclosed by reporter Guanping Zhang
- 2026-06-12: advisory: CVE-2026-50629 and GHSA-f8p7-h97q-7vx7 published
- 2026-06-12: patched: Patches released in versions 4.2.2 and 4.1.7