CVE-2026-50630

Vulnerability

A CRLF injection vulnerability exists in the AuthorizationUtils class of Apache CXF's OAuth2 module (cxf-rt-rs-security-oauth2). When constructing the WWW-Authenticate response header, the realm parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. Affected versions are 4.2.0 before 4.2.2 and all versions before 4.1.7 [1].

Exploitation

An attacker must be able to control the realm value passed to the OAuth2 authorization endpoint. By injecting CRLF sequences (e.g., %0d%0a) into the realm, the attacker can insert arbitrary HTTP headers or split the HTTP response body, leading to HTTP response splitting [1].

Impact

Successful exploitation allows an attacker to perform HTTP response splitting, which can be leveraged for cache poisoning, cross-site scripting (XSS), or session fixation attacks. The attacker can inject arbitrary headers or content into the HTTP response, potentially affecting downstream clients or proxies [1].

Mitigation

Users should upgrade to Apache CXF 4.2.2 or 4.1.7, which sanitize CR and LF characters in the realm parameter. No workarounds are documented; the fix is included in these releases [1].