← Vulnerability feed

Vulnerability record · CVE-2026-88920 · published 30 September 2026

CVE-2026-88920: Apache wss4j improper authentication vulnerability

Apache · Wss4j

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

9.8 CVSS 3.1 Critical EPSS 0.57% · top 54.7% CWE-287 · Improper authentication
9.8CVSS 3.1 base score
0.57%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
2 Oct 2026Last modified by NVD

Description

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9 Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/30/10 Mailing ListThird Party Advisory

Track CVE-2026-88920 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2020-13936Apache velocity engine vulnerabilityAn attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as th…EPSS 23%7.5CVE-2026-85532Apache wss4j improper input validation vulnerabilityApache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or e…EPSS 0.55%7.5CVE-2015-0226Apache wss4j broken cryptographic algorithm vulnerabilityApache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message …EPSS 5.5%5.9CVE-2011-2487Apache cxf broken cryptographic algorithm vulnerabilityThe implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbac…EPSS 1.8%5.0CVE-2015-0227Apache wss4j permissions and access controls vulnerabilityApache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors …EPSS 7.5%5.0CVE-2014-3623Apache wss4j improper authentication vulnerabilityApache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does …EPSS 9.2%4.8CVE-2026-92899Apache wss4j authentication bypass by spoofing vulnerabilityApache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but …EPSS 0.51%7.5CVE-2026-42018JFrog Artifactory improper authentication leaks anonymous tokenJFrog Artifactory can return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled. Because the token …KEVEPSS 9.8%analysed

Source: NIST National Vulnerability Database (record CVE-2026-88920), CISA KEV, FIRST EPSS (scores of 2026-10-05). This page is refreshed as NVD updates the record.