VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Jun 12, 2026· Updated Jun 12, 2026

CVE-2026-50629

CVE-2026-50629

Description

The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Apache/Cxf
    cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*
    Range: <4.1.7
  • Apache/OAuth2llm-create
    Range: <4.2.2 or <4.1.7 depending on branch

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.