CVE-2026-50629: Apache CXF log injection in OAuth2 clientId parameter

CVE-2026-50629 · Severity: high · CVSS 8.2 · Published 2026-06-12

Apache CXF is a popular open-source framework for building web services, including OAuth2 authentication support. An attacker can send a crafted HTTP request with special characters in the client identifier field, which gets logged without sanitization, allowing them to inject fake log entries or hide real security events. This could be used to cover tracks after a breach or manipulate log-based security monitoring.

Technologies: org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-50629 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50629 being exploited in the wild.
How severe is CVE-2026-50629?
High severity, with a CVSS score of 8.2, published 12 June 2026.
Which products and versions are affected?
Apache Software Foundation CXF (cxf-rt-rs-security-oauth2) 4.2.0 to 4.2.1, all versions before 4.1.7; org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven) ECOSYSTEM:introduced=4.2.0,fixed=4.2.2.
Is there a fix for CVE-2026-50629?
Yes. org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven): upgrade to 4.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50629 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50629?
Check whether you run Apache Software Foundation CXF (cxf-rt-rs-security-oauth2) or org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven): upgrade to 4.2.2 or later
    # set org.apache.cxf:cxf-rt-rs-security-oauth2 to 4.2.2 in your pom.xml or build.gradle

Technical details

This is a CRLF injection vulnerability (CWE-93) in the OAuth2 server logging code. The vulnerable component directly concatenates the 'clientId' query parameter from incoming HTTP requests into log warning messages without neutralizing control characters such as carriage return (\r) and line feed (\n). An attacker can exploit this via a network request to the OAuth2 endpoint by crafting a malicious clientId parameter (e.g., `clientId=attacker%0Ainjected_log_entry`) to inject arbitrary content into server logs. No authentication is required, attack complexity is low, and the attack surface is the publicly exposed OAuth2 endpoint. An attacker can achieve high confidentiality impact (log tampering exposes sensitivity) and low integrity impact (fake log entries). Patches are available in Apache CXF 4.2.2 and 4.1.7.

Affected products

  • Apache CXF 4.2.0 to 4.2.1, < 4.1.7

Identifiers

  • CVE-2026-50629
  • GHSA-f8p7-h97q-7vx7

Timeline

  • 2026-06-11: disclosed: Vulnerability disclosed by reporter Guanping Zhang
  • 2026-06-12: advisory: CVE-2026-50629 and GHSA-f8p7-h97q-7vx7 published
  • 2026-06-12: patched: Patches released in versions 4.2.2 and 4.1.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.