{"id":"CVE-2026-89238","published":"2026-09-30T13:17:21.587","lastModified":"2026-10-06T17:26:05.287","description":"WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass.\nUsers are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-345"],"vendors":["apache"],"products":["wss4j"],"references":[{"url":"https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/11","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw in WSS4J allows an attacker to confuse the EncryptedHeader, promoting an attacker-controlled plaintext element as the decrypted header, leading to potential policy bypass and loss of confidentiality.","exploitability":"Exploitation requires knowledge of the specific WSS4J implementation and access to the affected endpoint. Precondition is the presence of the vulnerable version of WSS4J in the system.","blast_radius":"If exploited, this could lead to unauthorized access and data exposure, impacting the confidentiality of the system's communications.","remediation":"Upgrade to WSS4J version 4.0.2 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","confidentiality","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:46:28.474Z"}}