CVE-2026-50630

A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Score
CVSS 3.1 6.5 Medium
Status
Modified - security@apache.org
Published
2026-06-12
Last modified
2026-10-26
Weaknesses
CWE-113

Affected products

References

 
 
© AVABIS GmbH privacypolicy about