When using WS-RM the first out-of-band message is necessary to generate a sequence identifier. CXF WS-RM implementation uses a message of the following form (and everything works):
If other clients are used, such as SoapUI, the message is generated slightly differently:
The issue is with the <wsa:Address> element, that is not an exact match to http://www.w3.org/2005/08/addressing/anonymous, but it contains an extra query parameter: ?id=0cbf2f7c-0e91-49b3-90d2-68219df51735.
CXF however tests for an exact match.
This is not a major issue, as there is an undocumented workaround to explicitly set the Acknowledgement to: field in the WS-RM field in SoapUI to the exact value of the ws-a anonymous url. However, given CXF's tradition of being strict with itself and lenient with other stacks, this is worth fixing.