CVE-2026-50629: Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier

June 12, 2026 (updated August 20, 2026)

The ‘clientId’ parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server’s log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

References

github.com/advisories/GHSA-f8p7-h97q-7vx7
lists.apache.org/thread/xw95po30p8th58ms1no6b0f2375cql00
nvd.nist.gov/vuln/detail/CVE-2026-50629

Code Behaviors & Features

Detect and mitigate CVE-2026-50629 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →