CVE-2026-50628 is a logic error in the Apache CXF OAuthRequestFilter, scored 9.8 critical. When IP binding is enabled, requests from the bound address are rejected and requests from any other address pass. Upgrade to CXF 4.2.2, 4.1.7 or 3.6.12, then retest the feature.
What's affected
Apache CXF, in the cxf-rt-rs-security-oauth2 module. The project announcement lists 4.2.0 before 4.2.2 and anything before 4.1.7, and the CVE record adds 3.6.12 as the fix for the 3.6 line.
The flaw matters only when the token IP binding feature is switched on. In that case the check is the wrong way round.
How to check if you're exposed
Check your CXF version first. For Maven:
mvn dependency:tree -Dincludes=org.apache.cxf
Then check whether you use the feature. Search your configuration and code for OAuthRequestFilter and for any setting that binds a token to the client IP address. If you never enabled IP binding, this bug has nothing to invert, though you should still upgrade.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Find services that use CXF OAuth2 and read their resolved CXF version.
- Upgrade to 4.2.2, 4.1.7 or 3.6.12.
- If you enabled IP binding, test it after the upgrade: a request from the bound address should pass and one from another address should fail.
- Do not rely on IP binding alone as a control, since addresses can be shared or change behind proxies.
- Review access logs from the period before the upgrade for tokens used from unexpected addresses.
Why it matters
IP binding is meant to make a stolen token less useful by tying it to the address it was issued for. A reversed comparison turns the control into its opposite: legitimate users are refused and everyone else is waved through. The record classes it as CWE-358, improperly implemented security check for standard, together with CWE-20, improper input validation.
The notable part is that the failure is easy to miss. Turning the feature on makes things worse, and the first symptom may be legitimate requests failing, which a team might fix by loosening other settings. The record does not report exploitation and the CVE is not in the CISA KEV catalog.
Quick check
Am I affected if I never enabled IP binding?
The record describes the problem as happening when the feature is enabled. Upgrade anyway, because the same release fixes CVE-2026-50627.
Is NVD's 9.8 score realistic?
It assumes no privileges and network access. Your real risk depends on whether you use the feature and what a token can reach.
Sources
Last reviewed: 19 October 2026.
