CVE-2026-50630
Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection
A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection
A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
CVE-2026-50630- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-113
- Updated
- 2026-11-02
EUVDEUVD-2026-36398
A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
EUVD-2026-36398- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xf62-wr5p-5p95
Apache CXF OAuth2 HTTP Response Splitting via WWW-Authenticate Realm Injection
A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
- Record
GHSA-xf62-wr5p-5p95- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-113
- Updated
- 2026-11-02
NVD
A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
CVE-2026-50630- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-113
- Updated
- 2026-11-05
OSV
Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection
A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
CVE-2026-50630- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-113
- Updated
- 2026-11-07
OSVGHSA-xf62-wr5p-5p95
Apache CXF OAuth2 HTTP Response Splitting via WWW-Authenticate Realm Injection
A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
- Record
GHSA-xf62-wr5p-5p95- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-113
- Updated
- 2026-11-02
OSVRHLW-2026-fd244c7ea4e4e9e4
Lightwell Security Advisory: cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003
Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003 with backported fixes for CVE-2026-50623, CVE-2026-50627, CVE-2026-50628, CVE-2026-50629, CVE-2026-50630, CVE-2026-50631, CVE-2026-57818, CVE-2026-61466, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481.
CVE-2026-50623: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
CVE-2026-50627: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator
CVE-2026-50628: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
CVE-2026-50629: Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier
CVE-2026-50630: Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection
CVE-2026-50631: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing
CVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
CVE-2026-61466: Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
CVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters
CVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
CVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider
This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9 from Maven Central.
- Record
RHLW-2026-fd244c7ea4e4e9e4- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-rt-rs-security-oauth2Maven |
4.2.0 up to 4.2.2 | 4.2.2 |
org.apache.cxf:cxf-rt-rs-security-oauth2Maven |
before 4.1.7 | 4.1.7 |
org.apache.cxf:cxf-rt-rs-security-oauth2Maven |
4.2.0 up to 4.2.2, plus listed versions 4.2.1 |
4.2.2 |
org.apache.cxf:cxf-rt-rs-security-oauth2Maven |
before 4.1.7, plus listed versions 2.6.02.6.12.6.102.6.112.6.12 Show 45 moreShow less2.6.132.6.142.6.152.6.162.6.172.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.02.7.12.7.102.7.112.7.122.7.132.7.142.7.152.7.162.7.172.7.182.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.93.0.03.0.0-milestone13.0.0-milestone23.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.163.0.23.0.3 |
4.1.7 |
org.apache.cxf:cxf-rt-rs-security-oauth2Red Hat Lightwell:Maven From an advisory covering 11 CVEs |
before 3.6.9.rhlw-00003, plus listed versions 2.6.02.6.12.6.102.6.112.6.12 Show 45 moreShow less2.6.132.6.142.6.152.6.162.6.172.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.02.7.12.7.102.7.112.7.122.7.132.7.142.7.152.7.162.7.172.7.182.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.93.0.03.0.0-milestone13.0.0-milestone23.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.163.0.23.0.3 |
3.6.9.rhlw-00003 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-50630 is a medium vulnerability (CVSS 6.5) in Apache Cxf, published June 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in org.apache.cxf:cxf-rt-rs-security-oauth2 4.2.2.
References
lists.apache.org/thread/bt7vnjzzkpd6vdhkxv103poor1jy5trm
openwall.com/lists/oss-security/2026/06/11/7
nvd.nist.gov/vuln/detail/CVE-2026-50630
github.com/advisories/GHSA-xf62-wr5p-5p95
repo.maven.apache.org/maven2
Show 41 moreShow less
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50627.json
access.redhat.com/errata/RHSA-2026:37390
Left out here: 196 versions. The JSON record has them.