CVE-2026-50629: Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier

Synopsis

Log injection vulnerability in Apache CXF's OAuth2 server component allows an unauthenticated remote attacker to write arbitrary content into server log files by supplying a crafted clientId parameter in HTTP requests. No authentication or user interaction is needed; the attacker sends a single malformed request over the network. Successful exploitation enables an attacker to forge fake log entries, obscure real audit trails, and read log-accessible credential or token data. A patched-image rebuild at versions 4.1.7 or 4.2.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Apache CXF OAuth2 endpoint over the network; no local access or special network position is required beyond a standard HTTP connection.

• AuthenticationNot required

  No account or credentials are needed; the injection is carried in the unauthenticated clientId parameter of an OAuth2 request.

• Victim interactionNot required

  The attacker sends a crafted HTTP request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout dependencies, or environmental factors must be satisfied.

Blast Radius

• Attacker writes forged log entries that masquerade as legitimate server events, undermining audit trails and forensic investigations.
• Attacker injects newline and control characters to hide evidence of prior malicious activity within the same log stream.
• Attacker reads confidential data surfaced in log context, such as OAuth2 token fragments or session identifiers written alongside the injected clientId.