CVE-2026-50630 Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection

🗓️ 12 Jun 2026 08:58:27Reported by apacheType

CVE-2026-50630: CXF OAuth2 realm injection enables response splitting; upgrade to 4.2.2 or 4.1.7.

Reporter	Title	Published	Views	Family All 11
Tenable Nessus	Apache CXF < 4.1.7 / 4.2.x < 4.2.2 Multiple Vulnerabilities	16 Jun 202600:00	–	nessus
Circl	CVE-2026-50630	11 Jun 202617:38	–	circl
CVE	CVE-2026-50630	12 Jun 202608:58	–	cve
EUVD	EUVD-2026-36398	12 Jun 202608:58	–	euvd
NVD	CVE-2026-50630	12 Jun 202610:16	–	nvd
OSV	CVE-2026-50630 Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection	12 Jun 202608:58	–	osv
Positive Technologies	PT-2026-48849	12 Jun 202600:00	–	ptsecurity
Snyk	HTTP Response Splitting	12 Jun 202611:07	–	snyk
vulnersOsv	no.ks.fiks:adresseregisteret-client (>=1.0.0 <=1.4.0), no.ks.fiks:fastlegeregisteret-client (>=1.0.0 <=1.4.0) +15 more potentially affected by CVE-2026-50630 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0 <=4.1.6)	12 Jun 202611:07	–	vulnersosv
vulnersOsv	no.ks.fiks:adresseregisteret-client (>=1.5.0 <=1.6.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0 <=1.6.0) +13 more potentially affected by CVE-2026-50630 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0 <=4.2.1)	12 Jun 202611:07	–	vulnersosv

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.cxf:cxf-rt-rs-security-oauth2",
    "product": "Apache CXF",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.2.2",
        "status": "affected",
        "version": "4.2.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.1.7",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/bt7vnjzzkpd6vdhkxv103poor1jy5trm

12 Jun 2026 08:58Current

EPSS0.00404

CWE-113