diff --git a/modules/kernel/src/org/apache/axis2/dispatchers/AddressingBasedDispatcher.java b/modules/kernel/src/org/apache/axis2/dispatchers/AddressingBasedDispatcher.java
index d1babf9f4b..3c9b3b21a2 100644
--- a/modules/kernel/src/org/apache/axis2/dispatchers/AddressingBasedDispatcher.java
+++ b/modules/kernel/src/org/apache/axis2/dispatchers/AddressingBasedDispatcher.java
@@ -112,6 +112,13 @@ public InvocationResponse invoke(MessageContext msgctx) throws AxisFault {
                     }
                 }
             }
+            // A RelatesTo that correlates to no operation context, such as a reply or
+            // fault sent on to a ReplyTo or FaultTo, still binds the service from the To
+            // here. Left unbound, the Dispatch phase binds it from that same To after the
+            // Security phase has run without it.
+            if (msgctx.getOperationContext() == null) {
+                response = super.invoke(msgctx);
+            }
         }
         //Else we will try to dispatch based on the WS-A Action
         else {
diff --git a/modules/kernel/test/org/apache/axis2/dispatchers/AddressingBasedDispatcherTest.java b/modules/kernel/test/org/apache/axis2/dispatchers/AddressingBasedDispatcherTest.java
index 16f992adee..1565b03e07 100644
--- a/modules/kernel/test/org/apache/axis2/dispatchers/AddressingBasedDispatcherTest.java
+++ b/modules/kernel/test/org/apache/axis2/dispatchers/AddressingBasedDispatcherTest.java
@@ -21,7 +21,12 @@
 import junit.framework.TestCase;
 
 import org.apache.axis2.addressing.AddressingConstants;
+import org.apache.axis2.addressing.EndpointReference;
+import org.apache.axis2.addressing.RelatesTo;
+import org.apache.axis2.context.ConfigurationContext;
+import org.apache.axis2.context.ConfigurationContextFactory;
 import org.apache.axis2.context.MessageContext;
+import org.apache.axis2.description.AxisService;
 
 public class AddressingBasedDispatcherTest extends TestCase {
 
@@ -39,4 +44,23 @@ public void testValidateActionFlag() throws Exception {
         AddressingBasedDispatcher dispatcher = new AddressingBasedDispatcher();
         dispatcher.invoke(mc);
     }
+
+    /**
+     * A RelatesTo that correlates to no operation context must not stop the service
+     * being bound from the To here, in the Addressing phase. Otherwise the Dispatch
+     * phase binds it from the same To after the Security phase has run with no
+     * service, and that service's security handlers never see the message.
+     */
+    public void testUncorrelatedRelatesToStillDispatchesOnTo() throws Exception {
+        ConfigurationContext cc = ConfigurationContextFactory.createEmptyConfigurationContext();
+        cc.getAxisConfiguration().addService(new AxisService("Service1"));
+        MessageContext mc = cc.createMessageContext();
+        mc.setTo(new EndpointReference("http://127.0.0.1:8080/axis2/services/Service1"));
+        mc.addRelatesTo(new RelatesTo("urn:uuid:no-such-operation-context"));
+
+        new AddressingBasedDispatcher().invoke(mc);
+
+        assertNotNull("the service must be bound from the To", mc.getAxisService());
+        assertEquals("Service1", mc.getAxisService().getName());
+    }
 }