IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-06-12 10:16

MODIFIED

2026-06-12 10:16

EPSS (Prob. Exploit)

0.44%

Top 62.0%

DATA SOURCES:

NVD 🔗 2026-06-12 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-01 GITHUB 🔗 2026-10-29 OSV 🔗 2026-11-02

> DESCRIPTION

The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-93

> CWE DETAILED DESCRIPTIONS

CWE-93: Improper Neutralization of CRLF Sequences - The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

> GITHUB SECURITY ADVISORY

GHSA-f8p7-h97q-7vx7 HIGH

Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier

AFFECTED PACKAGES:

MAVEN / org.apache.cxf:cxf-rt-rs-security-oauth2

< 4.1.7

Fixed in: 4.1.7

MAVEN / org.apache.cxf:cxf-rt-rs-security-oauth2

>= 4.2.0, < 4.2.2

Fixed in: 4.2.2

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier

AFFECTED PACKAGES:

Unknown / Unknown

48 versions affected

ALIASES:

GHSA-f8p7-h97q-7vx7

> HISTORIQUE DES MODIFICATIONS

Première apparition

12/06/2026 10:16

Source: NVD

📊 ENRICHISSEMENT 01/11/2026 06:59

CWE

Champ modifié: Description CWE

Ancienne valeur:

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') - The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutr...

Nouvelle valeur:

📊 ENRICHISSEMENT 01/07/2026 06:01

CWE