CVE-2026-50630 Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection

🗓️ 12 Jun 2026 08:58:27Reported by GoogleType

osv

osv🔗 osv.dev👁 2 Views

CVE-2026-50630: CXF OAuth2 CRLF realm injection enables header split; upgrade to 4.2.2 or 4.1.7.

Reporter	Title	Published	Views	Family All 11
Tenable Nessus	Apache CXF < 4.1.7 / 4.2.x < 4.2.2 Multiple Vulnerabilities	16 Jun 202600:00	–	nessus
Circl	CVE-2026-50630	11 Jun 202617:38	–	circl
CVE	CVE-2026-50630	12 Jun 202608:58	–	cve
Cvelist	CVE-2026-50630 Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection	12 Jun 202608:58	–	cvelist
EUVD	EUVD-2026-36398	12 Jun 202608:58	–	euvd
NVD	CVE-2026-50630	12 Jun 202610:16	–	nvd
Positive Technologies	PT-2026-48849	12 Jun 202600:00	–	ptsecurity
Snyk	HTTP Response Splitting	12 Jun 202611:07	–	snyk
vulnersOsv	no.ks.fiks:adresseregisteret-client (>=1.0.0 <=1.4.0), no.ks.fiks:fastlegeregisteret-client (>=1.0.0 <=1.4.0) +15 more potentially affected by CVE-2026-50630 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0 <=4.1.6)	12 Jun 202611:07	–	vulnersosv
vulnersOsv	no.ks.fiks:adresseregisteret-client (>=1.5.0 <=1.6.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0 <=1.6.0) +13 more potentially affected by CVE-2026-50630 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0 <=4.2.1)	12 Jun 202611:07	–	vulnersosv

Source	Link
openwall	www.openwall.com/lists/oss-security/2026/06/11/7
repo	www.repo.maven.apache.org/maven2
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50630.json
lists	www.lists.apache.org/thread/bt7vnjzzkpd6vdhkxv103poor1jy5trm
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-50630

08 Jul 2026 08:13Current

6Medium risk

Vulners AI Score6

CVSS 3.16.5

EPSS0.00404

Apache CXF OAuth two crlf injection header split realm handling www header upgrade recommended