CVE-2026-50629

Name of the Vulnerable Software and Affected Versions OAuth2 server versions prior to 4.2.2 OAuth2 server versions prior to 4.1.7

Description The clientId parameter from incoming HTTP requests is directly concatenated into server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, such as fake log entries, into the server's log files.

Recommendations Update to version 4.2.2. Update to version 4.1.7. As a temporary workaround, restrict or sanitize the clientId parameter in incoming HTTP requests to prevent the injection of control characters.