CVE-2026-50628

A logic error (CWE-20 — improper input validation) occurs in the OAuthRequestFilter module of Apache CXF, which reverses the operation of the IP address verification mechanism. The filter is designed to restrict access only to the associated IP address, but due to the error, it rejects requests from that exact address, while requests from any other IP address are accepted without restrictions. A remote, unauthenticated attacker can fully bypass IP address-based access control.

An attacker without any authentication can gain unauthorized access to resources protected by the IP filtering mechanism, leading to violations of confidentiality, integrity, and availability of data and services.

Apache CXF should be updated to version 4.2.2 or 4.1.7, which contain a fix for this error. Until updating, it is recommended to disable IP filtering based on OAuthRequestFilter or implement external access control mechanisms (e.g., at the firewall or reverse proxy level).

Apache CXF in versions prior to 4.2.2 and 4.1.7, in configurations with OAuthRequestFilter enabled with IP address verification