The CXF code that is used by the implementation replaces the address "127.0.0.1" by localhost for the UriBuilder.
This can be disabled or enabled by an option but it defaults to true.
If the host is replaced and you build a "location created" reply using the URI builder the host used by the request and response can differ.
If the client that sends the request uses the response location to access a resource browser will block that request because of CORS.
For further details and examples please have a look at: https://issues.apache.org/jira/browse/CXF-8190
It would be great if the Aries JAX-RS Whiteboard implementation could set this option to false to allow expected URI builder usage: