Apache CXF EUVD-2026-36398

Exploitation requires that an attacker can control or influence the 'realm' parameter value that the OAuth2 AuthorizationUtils class uses when constructing the WWW-Authenticate response header. If the realm is sourced entirely from static server-side configuration with no user-input pathway, exploitation is not possible even on vulnerable versions. Exploitation is further constrained by the need for a downstream HTTP client (browser, proxy, or API consumer) to process and act on the injected headers - a UI:R dependency. The attack does not require authenticated access to the CXF endpoint itself, but does require a data-flow path from attacker-controlled input into the realm value. Deployments on versions outside the affected ranges (4.2.2+ or 4.1.7+, or the 3.6.x line if unaffected) are not vulnerable. No privilege escalation on the server itself is possible; impact is confined to HTTP response manipulation affecting clients.

The vendor-assigned severity is 'low', consistent with the conditional exploitation requirement - an attacker must be able to control the realm value used by AuthorizationUtils, which is not universally achievable from an unauthenticated external position. No CVSS vector was provided by NVD or the vendor advisory, so metrics are inferred from the description. An independently assessed vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N reflects the network delivery, the elevated complexity of controlling the realm parameter, the scope change (affecting downstream HTTP clients or browsers), and low-to-moderate confidentiality and integrity impacts via header injection. EPSS data is not available in the provided input. There is no CISA KEV listing and no public proof-of-concept identified. Real-world risk is context-dependent: deployments that derive the OAuth2 realm from user-supplied or attacker-influenced input (e.g., query parameters, client-controlled request values) face meaningfully higher risk than those where realm is entirely server-side configured. The absence of a scope-change mitigation in the patch (pure input sanitization) suggests the blast radius is contained to HTTP clients processing the poisoned response rather than server-side data integrity.

An attacker targets a web application that exposes an Apache CXF OAuth2 endpoint where the realm value is dynamically derived from a client-controlled input such as a query parameter or Authorization header field. The attacker crafts a request embedding CRLF sequences in the realm value (e.g., realm="legit\r\nSet-Cookie: session=attacker"), causing the server to emit a malformed WWW-Authenticate header. A downstream HTTP client or caching proxy processing this response treats the injected content as a legitimate header, enabling session fixation, cache poisoning, or redirection to an attacker-controlled resource. No public proof-of-concept code has been identified at time of analysis.