EUVD-2026-36397
GHSA-f8p7-h97q-7vx7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible OAuth2 endpoint accepts clientId without prior authentication; impact is limited to log integrity corruption with no confidentiality or availability effect.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
Log injection in Apache CXF's OAuth2 module (org.apache.cxf:cxf-rt-rs-security-oauth2) permits remote attackers to forge arbitrary log entries by supplying crafted clientId values containing control characters or newline sequences in OAuth2 HTTP requests. Affected are CXF 4.2.0-4.2.1 and all 4.1.x versions before 4.1.7; fixed releases 4.2.2 and 4.1.7 were issued June 10, 2026. No public exploit code or active exploitation has been identified at time of analysis; practical impact is confined to log integrity compromise that could mislead security monitoring and incident response processes.
Technical ContextAI
Apache CXF is a widely deployed open-source Java services framework supporting JAX-WS and JAX-RS for SOAP and RESTful web services. The vulnerable component is the cxf-rt-rs-security-oauth2 Maven artifact, which implements the OAuth2 authorization server logic. The root cause is a classic CWE-117 (Improper Output Neutralization for Logs) / CWE-93 (Improper Neutralization of CRLF Sequences) flaw: the clientId value extracted directly from incoming HTTP request parameters is concatenated into server log warning messages without stripping or escaping control characters such as carriage return (\r) and line feed (\n). An attacker-supplied clientId containing these characters terminates the current log line and injects synthetic log entries that appear indistinguishable from legitimate server-generated output, undermining the trustworthiness of log-based detection and audit trails.
RemediationAI
Upgrade to Apache CXF 4.2.2 if running any 4.2.x build, or to 4.1.7 if running any 4.1.x build; both releases were made available June 10, 2026, and are downloadable from https://cxf.apache.org/. If immediate patching is not feasible, the following specific compensating controls reduce exposure: restrict network access to OAuth2 token and authorization endpoints to known, trusted client IP ranges via WAF rules or network ACLs, which limits the population of potential injectors; configure log aggregation pipelines (e.g., Logstash, Fluentd) to detect or strip raw CRLF sequences before log ingestion, reducing the effectiveness of injected entries in SIEM systems; and treat all OAuth2-related warning log output with heightened scrutiny during incident investigations until patching is complete. None of these workarounds fix the underlying concatenation flaw - they reduce opportunity or mitigate downstream confusion only.
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attac
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote att
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inver
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to tr
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Conn
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attac
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a cons
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryp
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today