{"id":"CVE-2026-97468","published":"2026-10-09T11:17:03.270","lastModified":"2026-10-15T17:17:33.127","description":"Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/hashCode()), and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token (for example a UsernameToken or a self-signed SAML Assertion) whose hash collides with a cached entry. The token would then be accepted without password validation, signature trust verification or a call to the STS. This could let the attacker authenticate as another user and, through STS token validation or renewal, obtain STS-signed tokens for that identity.\nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-328"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/qthbnsyhqsxhl9p2h9v5dg4mnwv1b9r6","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/09/9","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache CXF's STS service incorrectly validates security tokens by caching them using a non-cryptographic 32-bit hash, making it vulnerable to hash collision attacks. An attacker can craft a malicious token that collides with a cached token, bypassing authentication and signature verification checks.","exploitability":"Exploitation requires crafting a token with a specific hash collision against an existing cached token, which is moderately difficult but feasible given sufficient access to the STS service and knowledge of the token structure.","blast_radius":"If exploited, this vulnerability could allow attackers to impersonate any user in systems using Apache CXF's STS, potentially leading to unauthorized access to protected resources and privilege escalation through token renewal capabilities.","remediation":"Upgrade to Apache CXF versions 4.2.4, 4.1.9, or 3.6.13 which contain the fix for this hash collision vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","sts","token-validation","hash-collision"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:48:35.019Z"}}