EUVD-2026-36396
GHSA-g5v7-jchf-7jrr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Once the optional IP-binding filter is enabled, any remote unauthenticated client from a non-bound IP bypasses the intended control, yielding full C/I/A impact on resources gated by that filter.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6Description PRE-NVD
AnalysisAI
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inverted IP-binding check rejects requests from the configured bound IP and permits requests from every other source address. The flaw turns an intended IP allowlist into an implicit deny-list of one, enabling remote unauthenticated attackers to reach protected OAuth endpoints from arbitrary networks. EPSS is low (0.04%) and no public exploit identified at time of analysis, but the trivial nature of the logic inversion makes exploitation straightforward once the misbehaving filter is enabled.
Technical ContextAI
Apache CXF is a widely deployed open-source services framework for building SOAP, REST, and OAuth-protected web services on the JVM. The OAuthRequestFilter is an OAuth 2.0 server-side request filter that, among other checks, can restrict which client IP addresses are permitted to invoke OAuth flows. The vulnerability is a CWE-20 Improper Input Validation manifesting as an inverted conditional in the IP-binding check: the boolean comparing the inbound source address to the configured bound IP is evaluated with reversed semantics, so legitimate matches are denied and non-matches are allowed. CPE data confirms apache:cxf as the affected component family, and the EUVD-listed version ranges (0 < 4.1.7 and 4.2.0 < 4.2.2) bracket both the 4.1.x maintenance line and the 4.2.x current line, indicating the defect was introduced or carried across both branches.
RemediationAI
Vendor-released patch: upgrade Apache CXF to 4.1.7 on the 4.1.x branch or 4.2.2 on the 4.2.x branch, both of which restore the correct IP comparison semantics in OAuthRequestFilter, per the Apache advisory at https://lists.apache.org/thread/vb3ho8lf228gh90m1fpnohf2008xrdxk and the oss-security disclosure at https://seclists.org/oss-sec/2026/q2/888. If immediate upgrade is not feasible, disable the OAuthRequestFilter IP-binding feature so the inverted check never executes, accepting the trade-off that any operational reliance on IP allowlisting at this layer is lost; alternatively, enforce the intended IP restriction upstream at a reverse proxy, WAF, or network ACL that filters on source address before requests reach CXF, which preserves the security goal but introduces an additional component to maintain.
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attac
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote att
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to tr
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Conn
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attac
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a cons
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryp
Remote code execution in Apache CXF's JCA integration module allows attackers to achieve arbitrary code execution via JN
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today