Wazuh’s API middleware decodes the Basic authentication username before verifying credentials and passes it straight to the access logger. The logger then interpolates the username into a plain‑text audit log without neutralizing control characters. As a result, an unauthenticated attacker can insert carriage return or line feed characters into the username field, forging log entries, concealing real activity, or corrupting log consumers that rely on the plain‑text format. The flaw is classified as improper output neutralization (CWE‑117).

The vulnerability affects Wazuh installations that use API middleware from version 4.4.0 up through 4.14.5 and earlier releases of the 5.0.0 beta series. Versions 4.14.6 and 5.0.0‑beta2 contain the fix and are not affected.

The CVSS score of 5.3 indicates moderate risk; no EPSS data is available, and the issue is not listed in CISA’s KEV catalog. Attackers can exploit the flaw without authentication by sending a crafted Basic‑Auth header to the API, allowing them to alter audit logs that may be analyzed by SIEMs or other monitoring tools. The lack of automated detection and the plain‑text log format make the impact particularly relevant for environments that parse logs for alerts or compliance. The fix requires upgrading to the patched versions; a temporary mitigation would involve disabling or sanitizing the username field in log output.