The flaw originates when the OAuth2 server concatenates an incoming clientId into warning logs without removing control characters. An attacker can therefore embed newlines or other special sequences to insert arbitrary text into the server’s log files. This capability classifies the weakness as CWE‑93, Log Injection, and permits an attacker to forge or corrupt audit entries, obscuring legitimate activity and hampering forensic investigations.

Apache CXF, part of the Apache Software Foundation, is affected by this issue. All releases prior to 4.2.2 and 4.1.7 contain the flaw; upgrading to version 4.2.2 or 4.1.7 removes the vulnerability.

An attacker can exploit the vulnerability remotely by sending a crafted HTTP request containing a malicious clientId to the OAuth2 endpoint. The EPSS score of less than 1% indicates a low probability of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, the CVSS score of 5.3 denotes moderate severity, reflecting the moderate impact on audit integrity. The fact that no public exploit is documented is inferred from the absence of such reports in the provided references.