This vulnerability arises from a logic error in the OAuthRequestFilter of Apache CXF's cxf-rt-rs-security-oauth2 module. The flawed logic causes an inverse security check that rejects legitimate requests from the bound IP address and allows requests from any other IP address. Consequently, an attacker who has obtained a valid OAuth2 access token via separate attack vectors (e.g., token leakage or interception) can replay the token from any IP address, bypassing sender-constrained token binding controls and gaining unauthorized access to protected resources. The flaw is identified as CWE-20 (Improper Input Validation) and CWE-358 (Improperly Implemented Security Check). The vulnerability has a CVSS v3.1 base score of 9.8 (critical severity). Vendor advisories recommend upgrading to fixed versions 4.2.2, 4.1.7, or 3.6.12. Red Hat currently does not provide a mitigation other than upgrading and rates the impact as Important due to the prerequisite token compromise.

Successful exploitation allows an attacker to bypass the sender-constrained token binding security control by replaying a stolen OAuth2 access token from any IP address, resulting in unauthorized access to protected resources with the privileges of the legitimate token holder. The vulnerability does not allow token theft directly but requires the attacker to have obtained a valid token through other means. The flaw compromises confidentiality and integrity with high impact, but availability impact is none or low.

A fix is available in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12. Users are strongly recommended to upgrade to these versions to remediate the vulnerability. No other effective mitigation is currently available or meets vendor criteria for ease of use and applicability. Red Hat advises applying the update as soon as possible.