This vulnerability in Apache CXF's OAuthRequestFilter arises from improper input validation (CWE-20) and a logic error that reverses the intended IP address check. Instead of allowing requests from the bound IP and rejecting others, it rejects legitimate requests from the bound IP and permits requests from any other IP address. This flaw effectively creates an inverse security check, potentially allowing unauthorized access. The issue is fixed in Apache CXF versions 4.2.2 and 4.1.7. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The Red Hat advisory confirms the vulnerability and recommends upgrading to patched versions.

The vulnerability allows unauthorized access due to a logic error in IP address validation within the OAuthRequestFilter. This can lead to attackers bypassing intended IP restrictions, potentially compromising confidentiality, integrity, and availability of affected systems running Apache CXF 4.2.0. The critical CVSS score of 9.8 reflects the high impact and ease of exploitation over the network without authentication or user interaction.

A fix is available. Users should upgrade Apache CXF to versions 4.2.2 or 4.1.7, which address this logic error in OAuthRequestFilter. The Red Hat advisory confirms the availability of these patched versions. No other mitigations are specifically recommended beyond applying the official fix.