Apache CXF EUVD-2026-36397

Exploitation requires that the target Apache CXF deployment includes the cxf-rt-rs-security-oauth2 module and exposes an active OAuth2 server endpoint reachable by the attacker. The attacker must be able to send HTTP requests with a controlled clientId parameter to that endpoint - no authentication is required since supplying a clientId is the precursor step to OAuth2 authentication flows. The vulnerability is present only in versions 4.2.0-4.2.1 and pre-4.1.7 builds. The impact is strictly bounded to log file content corruption; the flaw cannot be used to achieve remote code execution, access protected data, or disrupt service availability. Exploitation is further constrained by the fact that injected content only appears in server log files and has no effect on request processing, authorization decisions, or application state.

The vendor classifies this as Low severity, which is appropriate given that the sole exploitable impact is log file integrity - no code execution, data exfiltration, or service disruption is achievable. No CVSS vector was provided in the input data; metrics are inferred from the description: the attack vector is network (clientId arrives via standard OAuth2 HTTP requests), attack complexity is low (no special prerequisites beyond reaching the endpoint), and no authentication appears necessary since OAuth2 client credential requests inherently precede authentication. EPSS data is absent, and the vulnerability is not listed in CISA KEV, with no public exploit code identified - all signals consistent with a low-urgency, low-impact finding. The real-world risk is primarily to organizations relying on CXF OAuth2 server logs for SIEM alerting or forensic investigation: injected entries could mask attacker activity or generate false positive alerts. There is no conflict between the available signals, but the absence of a vendor-provided CVSS vector means attack complexity and privilege metrics are inferred rather than confirmed.

An unauthenticated remote attacker sends an OAuth2 authorization or token request to the CXF server with a clientId value such as legitimate-client\nWARN 2026-06-11 00:00:00 Successful admin login from 10.0.0.1. The server logs this clientId verbatim as part of a warning message, causing the injected text to appear as a distinct, legitimate-looking log entry. A security analyst or automated SIEM rule processing the log file may then be misled into treating the forged entry as authentic server output, potentially masking actual attacker activity or generating false alarms.