{"id":"CVE-2026-50629","aliases":["EUVD-2026-36397","GHSA-542g-m3fx-q86f","GHSA-83r6-96m8-r52p","GHSA-9mrv-8pvf-hf4m","GHSA-f8p7-h97q-7vx7","GHSA-g5v7-jchf-7jrr","GHSA-xf62-wr5p-5p95","RHLW-2026-fd244c7ea4e4e9e4"],"status":"published","title":"Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier","description":"The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00437,"percentile":0.38391,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-93"],"published":"2026-06-12T08:57:22Z","modified":"2026-11-05T15:56:26Z","fixes":[{"ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","fixed_in":["4.2.2","4.1.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.2.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.2.2"}]}],"versions":["4.2.0","4.2.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7"}]}],"versions":["2.6.0","2.6.1","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.16","2.6.17","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.16","2.7.17","2.7.18","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","3.0.0","3.0.0-milestone1","3.0.0-milestone2","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.3.0","3.3.1","3.3.10","3.3.11","3.3.12","3.3.13","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.3.8","3.3.9","3.4.0","3.4.1","3.4.10","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9","3.5.0","3.5.1","3.5.10","3.5.11","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.1","3.6.10","3.6.11","3.6.12","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.6.8","3.6.9","4.0.0","4.0.1","4.0.10","4.0.11","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.1.0","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9.rhlw-00003"}]}],"versions":["2.6.0","2.6.1","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.16","2.6.17","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.16","2.7.17","2.7.18","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","3.0.0","3.0.0-milestone1","3.0.0-milestone2","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.3.0","3.3.1","3.3.10","3.3.11","3.3.12","3.3.13","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.3.8","3.3.9","3.4.0","3.4.1","3.4.10","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9","3.5.0","3.5.1","3.5.10","3.5.11","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.6.8","3.6.9"],"bundled":11}],"products":[{"vendor":"apache","product":"cxf"},{"vendor":"apache software foundation","product":"apache cxf"}],"references":[{"url":"https://lists.apache.org/thread/xw95po30p8th58ms1no6b0f2375cql00","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/06/11/6","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50629","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f8p7-h97q-7vx7","tags":["advisory"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50629.json","tags":["advisory"]},{"url":"https://github.com/apache/cxf","tags":["package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50623.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/ydzj8m5mqmjy13xgyj9mkk9hfff63qq7","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50623","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-542g-m3fx-q86f","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50627.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50627","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50627.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/0jfzz9q992957b99tw7hodcqjfyxwb1m","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50627","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9mrv-8pvf-hf4m","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50628.json","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50628","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50628.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/vb3ho8lf228gh90m1fpnohf2008xrdxk","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50628","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g5v7-jchf-7jrr","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50630.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/bt7vnjzzkpd6vdhkxv103poor1jy5trm","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50630","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xf62-wr5p-5p95","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50631.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/s83t3x4r626o9h8rt0ryr1w7w53l1vv8","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50631","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-83r6-96m8-r52p","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57818.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/7q08mz8bcbosp25wok7gr537zlp15mfz","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57818","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61466.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/2l1r16g79tpxd7fzrzr2q9oscwrjgljs","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61466","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63687.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/drcq4chmt0btx86f17o47j17r378hzpw","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63687","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68079.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68079","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68481.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/88c0h10yjb2b8201o1km3st71fs2zw2b","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68481","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-50629","title":"Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier","description":"The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.","status":"published","published":"2026-06-12T08:57:22.534Z","modified":"2026-08-07T12:43:09.466Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:20:08.734143Z"}],"euvd":[{"id":"EUVD-2026-36397","description":"The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.","status":"published","published":"2026-06-12T08:57:22Z","modified":"2026-08-07T12:43:09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:07.294457Z"}],"ghsa":[{"id":"GHSA-f8p7-h97q-7vx7","title":"Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier","description":"The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.","status":"published","published":"2026-06-12T12:31:33Z","modified":"2026-08-20T18:31:36Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:41:03.602876Z"}],"nvd":[{"id":"CVE-2026-50629","description":"The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.","status":"published","published":"2026-06-12T10:16:22.83Z","modified":"2026-11-05T15:56:26.507Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-93"],"updated_at":"2026-11-05T19:55:55.702046Z"}],"osv":[{"id":"CVE-2026-50629","title":"Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier","description":"The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.","status":"published","published":"2026-06-12T08:57:22.534Z","modified":"2026-11-07T02:48:29.517760095Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-07T03:08:06.729372Z"},{"id":"GHSA-f8p7-h97q-7vx7","title":"Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier","description":"The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.","status":"published","published":"2026-06-12T12:31:33Z","modified":"2026-08-20T18:48:08.701423Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"RHLW-2026-fd244c7ea4e4e9e4","title":"Lightwell Security Advisory: cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003","description":"Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003 with backported fixes for CVE-2026-50623, CVE-2026-50627, CVE-2026-50628, CVE-2026-50629, CVE-2026-50630, CVE-2026-50631, CVE-2026-57818, CVE-2026-61466, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481.\n\nCVE-2026-50623: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService\n\nCVE-2026-50627: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator\n\nCVE-2026-50628: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control\n\nCVE-2026-50629: Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier\n\nCVE-2026-50630: Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection\n\nCVE-2026-50631: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing\n\nCVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider\n\nCVE-2026-61466: Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation\n\nCVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters\n\nCVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay\n\nCVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider\n\nThis patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9 from Maven Central.","status":"published","published":"2026-10-13T21:10:18Z","modified":"2026-10-27T04:13:03.043123153Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:59.135214Z"}]}}