EUVD-2026-36396
GHSA-g5v7-jchf-7jrr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify CXF OAuth endpoint with IP-binding enabled
-
DeliverySend OAuth request from non-bound IP
-
ExploitInverted filter check admits request
-
ExecutionReach protected OAuth resource
-
ImpactObtain tokens or invoke privileged operation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires that an administrator has explicitly enabled the OAuthRequestFilter IP-binding security feature on an Apache CXF deployment running a vulnerable version (anything below 4.1.7 on the 4.1.x line, or 4.2.0 / 4.2.1 on the 4.2.x line); on default configurations without this filter enabled the inverted check is never reached and the vulnerability is not exposed. Once enabled, no authentication, user interaction, or special network position is needed - the attacker simply must originate from any IP address other than the configured bound IP, which is the trivially common case for an external attacker. The limiting factor is therefore deployment posture, not attacker capability. |
| Impact | The published CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 9.8 (Critical) and is internally consistent with a remote unauthenticated bypass, but its real-world risk is significantly narrower than the headline number: the issue only manifests when an operator has explicitly enabled OAuthRequestFilter's IP-binding feature, so unaffected default deployments dominate the install base. EPSS at 0.04% (11th percentile) and absence from the CISA KEV catalog align with this: there is no public exploit identified at time of analysis and no evidence of mass exploitation. The C/I/A:H impact ratings assume the bypassed filter was the sole protection layer - in stacked OAuth deployments with additional authentication checks the effective impact is lower. Net: prioritize for any deployment that has turned on OAuth IP-binding, deprioritize for installs that never enabled this filter; the SSVC-style read is exploitation:none, automatable:yes, technical impact:total once preconditions hold. |
| Exploit ScenarioDerived | An attacker discovers a public OAuth endpoint fronted by Apache CXF where the operator enabled OAuthRequestFilter IP-binding to restrict callers to a specific internal address. Because the filter's check is inverted, the attacker simply issues normal OAuth requests from their own external IP and is admitted, while the legitimate bound IP is rejected; from there they can complete OAuth flows and reach protected resources that the operator believed were IP-restricted. No public exploit identified at time of analysis, but reproduction requires only a standard HTTP client. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 15, 2026
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inverted IP-binding check rejects requests from the configured bound IP and permits requests from every other source address. The flaw turns an intended IP allowlist into an implicit deny-list of one, enabling remote unauthenticated attackers to reach protected OAuth endpoints from arbitrary networks. EPSS is low (0.04%) and no public exploit identified at time of analysis, but the trivial nature of the logic inversion makes exploitation straightforward once the misbehaving filter is enabled.
Earlier versions of this analysis (2)
Authorization bypass in Apache CXF's OAuthRequestFilter (versions before 4.1.7 and 4.2.0 through 4.2.1) inverts an IP-binding security control, causing the filter to reject only the legitimate bound IP while permitting requests from every other source address. Remote attackers can reach OAuth-protected endpoints that operators believed were locked down to a specific client IP. Patches are available (4.1.7, 4.2.2); no public exploit identified at time of analysis and EPSS is very low (0.04%, 11th percentile), reflecting that the flaw only manifests when the IP-binding feature is explicitly enabled.
OAuth2 IP binding in Apache CXF's OAuthRequestFilter contains an inverted logic error that completely negates the security control it is designed to enforce: requests from the IP address bound to a token are rejected, while requests from all other IP addresses are accepted without restriction. Affected deployments include Apache CXF versions 4.2.0 through 4.2.1 and all releases before 4.1.7 using the cxf-rt-rs-security-oauth2 artifact with IP binding explicitly enabled. Attackers in possession of a valid OAuth2 token can bypass the IP-binding control entirely, using the token from any IP address; simultaneously, legitimate token owners at the bound IP are denied service, creating a combined authorization bypass and availability impact. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
RemediationAI
Vendor-released patch: upgrade Apache CXF to 4.1.7 on the 4.1.x branch or 4.2.2 on the 4.2.x branch, both of which restore the correct IP comparison semantics in OAuthRequestFilter, per the Apache advisory at https://lists.apache.org/thread/vb3ho8lf228gh90m1fpnohf2008xrdxk and the oss-security disclosure at https://seclists.org/oss-sec/2026/q2/888. If immediate upgrade is not feasible, disable the OAuthRequestFilter IP-binding feature so the inverted check never executes, accepting the trade-off that any operational reliance on IP allowlisting at this layer is lost; alternatively, enforce the intended IP restriction upstream at a reverse proxy, WAF, or network ACL that filters on source address before requests reach CXF, which preserves the security goal but introduces an additional component to maintain.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache CXF is a widely deployed open-source services framework for building SOAP, REST, and OAuth-protected web services on the JVM. The OAuthRequestFilter is an OAuth 2.0 server-side request filter that, among other checks, can restrict which client IP addresses are permitted to invoke OAuth flows. The vulnerability is a CWE-20 Improper Input Validation manifesting as an inverted conditional in the IP-binding check: the boolean comparing the inbound source address to the configured bound IP is evaluated with reversed semantics, so legitimate matches are denied and non-matches are allowed. CPE data confirms apache:cxf as the affected component family, and the EUVD-listed version ranges (0 < 4.1.7 and 4.2.0 < 4.2.2) bracket both the 4.1.x maintenance line and the 4.2.x current line, indicating the defect was introduced or carried across both branches.
Know when Cxf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Once the optional IP-binding filter is enabled, any remote unauthenticated client from a non-bound IP bypasses the intended control, yielding full C/I/A impact on resources gated by that filter.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4Description PRE-NVD
Blast Radius
ecosystem impact- 15 maven packages depend on org.apache.cxf:cxf-rt-rs-security-oauth2 (8 direct, 7 indirect)
Ecosystem-wide dependent count for version 4.2.0.
Executive ViewAI
Apache CXF's OAuth authentication filter contains a critical logic flaw that inverts IP binding validation, disabling intended access restrictions and exposing protected OAuth endpoints to unauthenticated remote access. Organizations operating OAuth services on CXF must patch immediately to prevent potential credential bypass and unauthorized API access.
Apply vendor patch. Interim mitigation if patch deployment is delayed: disable OAuthRequestFilter if operationally feasible, or implement network-level IP allowlists at firewall/load balancer to restrict OAuth endpoint access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attac
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote att
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to tr
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Conn
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attac
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a cons
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryp
Exploit-DB