A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address while blindly allowing requests from any other IP address, effectively creating an inverse security check. This flaw causes legitimate clients to be denied access and enables unauthenticated attackers to bypass the IP binding constraint by using arbitrary IP addresses, thereby gaining unauthorized access to protected resources. The weakness is improper input validation (CWE‑20).

The vulnerability affects Apache CXF implementations that use an OAuth2 request filter with IP binding enabled. Versions of Apache CXF released before 4.2.2 and 4.1.7 are impacted. Patching to these or newer releases removes the issue.

The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been documented. The risk remains high, with a CVSS score of 9.8 indicating critical severity, because the flaw permits IP spoofing or bypass of IP‑based access controls if the application relies on this binding for security. An attacker could exploit the issue by sending HTTP requests from a non‑bound IP, potentially gaining unauthorized access. Due to the low EPSS score, the likelihood of exploitation is uncertain, but the vulnerability's impact on confidentiality and integrity makes it a serious concern when the affected configuration is in use.