The vulnerability identified as CVE-2026-50629 in Apache CXF involves improper neutralization of CRLF sequences (CWE-93). Specifically, the 'clientId' parameter from incoming HTTP requests is concatenated directly into OAuth2 server log warning messages without sanitization of control characters. This flaw enables an attacker to inject arbitrary content, such as fake log entries, into the server's log files. The vulnerability affects multiple versions of Apache CXF prior to 4.1.7 and 4.2.2, with fixed versions being 4.1.7, 4.2.2, and 3.6.12. The CVSS v3.1 base score is 5.3, indicating a medium severity level, with an attack vector of network, low attack complexity, no privileges required, no user interaction, and impact limited to integrity (log integrity). There are no known exploits in the wild at this time.

An attacker can inject arbitrary content, including fake log entries, into the server's log files by exploiting the lack of sanitization of the 'clientId' parameter in log messages. This can lead to log pollution, potentially misleading administrators or automated systems that rely on log data for security monitoring and incident response. There is no direct impact on confidentiality or availability reported.

Users should upgrade Apache CXF to versions 4.2.2, 4.1.7, or 3.6.12 where this issue is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory recommending these versions.