GHSA-g5v7-jchf-7jrr: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

Q: Who is exposed to this issue?

Apache CXF deployments that use OAuthRequestFilter and have enabled its IP-binding security feature are exposed. The affected control allows requests from IP addresses other than the configured bound address.

Q: What does an attacker need to exploit it?

An attacker needs to make an OAuth-related request from an IP address that is not the IP address bound by the affected security feature. The supplied severity vector indicates network exploitation requires no privileges or user interaction.

Q: Are installations that do not use IP binding affected by this behavior?

The described flaw is in the IP-binding check in OAuthRequestFilter. The provided information identifies exposure when that security feature is enabled; it does not establish impact for deployments that do not use it.

Q: What versions fix the issue?

Upgrade Apache CXF to version 4.2.2, 4.1.7, or 3.6.12. These versions are identified as containing the fix.

Published Jun 12, 2026

Updated

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this

security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Affected Software

1 affected component

Apache CXF<4.2.2, <4.1.7, <3.6.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.2.2
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.1.7
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 3.6.12

Event History

Jun 12, 2026

CVE Published

via OSV·08:56 AM

Data Sourced

via OSV·08:56 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Apache CXF deployments that use OAuthRequestFilter and have enabled its IP-binding security feature are exposed. The affected control allows requests from IP addresses other than the configured bound address.

What does an attacker need to exploit it?

An attacker needs to make an OAuth-related request from an IP address that is not the IP address bound by the affected security feature. The supplied severity vector indicates network exploitation requires no privileges or user interaction.

Are installations that do not use IP binding affected by this behavior?

The described flaw is in the IP-binding check in OAuthRequestFilter. The provided information identifies exposure when that security feature is enabled; it does not establish impact for deployments that do not use it.

What versions fix the issue?

Upgrade Apache CXF to version 4.2.2, 4.1.7, or 3.6.12. These versions are identified as containing the fix.

GHSA-g5v7-jchf-7jrr: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are installations that do not use IP binding affected by this behavior?

What versions fix the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are installations that do not use IP binding affected by this behavior?

What versions fix the issue?