PT-2026-48848 · Apache · Apache Cxf
Published
2026-06-12
·
Updated
2026-06-12
·
CVE-2026-50629
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Cxf