A logic flaw in Apache CXF's OAuthRequestFilter causes the IP binding check to be inverted: requests from the bound IP are rejected while those from any other IP are accepted. The result is that legitimate clients can be denied access and unauthenticated attackers can use arbitrary IP addresses to bypass the binding constraint, thereby obtaining unauthorized access to protected resources. This is a type of improper input validation failure (CWE‑20).

The vulnerability affects Apache CXF implementations that use an OAuth2 request filter with IP binding enabled. Versions of Apache CXF released before 4.2.2 and 4.1.7 are impacted. Patching to these or newer releases removes the issue.

The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been documented. The risk remains high, with a CVSS score of 9.8 indicating critical severity, because the flaw permits IP spoofing or bypass of IP‑based access controls if the application relies on this binding for security. An attacker could exploit the issue by sending HTTP requests from a non‑bound IP, potentially gaining unauthorized access. Due to the low EPSS score, the likelihood of exploitation is uncertain, but the vulnerability's impact on confidentiality and integrity makes it a serious concern when the affected configuration is in use.