{"id":"CVE-2026-88920","published":"2026-09-30T12:17:14.203","lastModified":"2026-10-02T20:17:49.397","description":"An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key.\n\nUsers are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":["apache"],"products":["wss4j"],"references":[{"url":"https://lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/10","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This flaw allows unauthenticated attackers to forge authenticated SOAP messages by exploiting a vulnerability in the DOM security processor of Apache WSS4J, leading to potential unauthorized access and manipulation of sensitive data.","exploitability":"Exploitation is relatively easy given the unauthenticated nature and the specific crafted assertion required, making it a high-risk vulnerability.","blast_radius":"If exploited, this could result in significant data breaches and unauthorized access to protected systems, impacting multiple users and services.","remediation":"Upgrade to Apache WSS4J version 4.0.2 or later to address this issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","soap","web-services","security"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-01T08:43:41.535Z"}}