Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-88920

Apache WSS4J: SAML Sender-Vouches Authentication Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache WSS4J

Default version status: unaffected

  • 4.0.0 to < 4.0.2affected
  • 3.0.0 to < 3.0.6affected
  • 0 to < 2.4.4affected
pkg:maven/org.apache.wss4j/wss4j-ws-security-dom

References