CVE-2026-50628: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

Synopsis

An authentication bypass affects Apache CXF's OAuth2 request filter (OAuthRequestFilter) due to an inverted IP address binding check. The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable by any remote attacker. Successful exploitation gives an attacker full read, write, and denial-of-service capability against the affected service; a patched-image rebuild at versions 4.1.7 and 4.2.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Apache CXF service over the network; no local or physical access is needed.

• AuthenticationNot required

  No credentials or session token are needed; the inverted IP check allows unauthenticated requests from any non-bound IP address.

• Victim interactionNot required

  The attacker sends requests directly to the service; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the logic error triggers consistently on any request arriving from an IP that is not the configured bound address.

Blast Radius

• Reads OAuth2-protected resources, which may include session tokens, access tokens, and any data exposed by the CXF service.
• Writes or modifies data through OAuth2-protected endpoints, including altering records or issuing unauthorized API operations.
• Crashes or degrades the affected Apache CXF service by sending malformed or high-volume requests through the unguarded filter path.
• Bypasses all IP-binding security controls, meaning any network-reachable attacker is treated as a trusted, pre-authorized client.