The vulnerability stems from the OAuth2 server’s use of the incoming clientId parameter in warning log messages without sanitizing control characters. As a result, an attacker can insert arbitrary text—including fake log entries—into the server’s logs. This injection is classified as CWE‑93, Log Injection, and allows an attacker to forge or corrupt audit records, obscuring real activity and hindering forensic investigations.

Apache CXF, maintained by the Apache Software Foundation, is affected by this issue. Every release prior to 4.2.2, 4.1.7, or 3.6.12 contains the flaw; upgrading to at least one of those versions fixes the vulnerability.

An attacker can exploit the vulnerability remotely by sending a crafted HTTP request containing a malicious clientId to the OAuth2 endpoint. The EPSS score of less than 1% indicates a low probability of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, the CVSS score of 5.3 denotes moderate severity, reflecting the moderate impact on audit integrity. The fact that no public exploit is documented is inferred from the absence of such reports in the provided references.