CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests

As cited

Copy frozen at 2026-10-09 13:24 UTC (site build).

vulnerabilities

CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests

Apache CXF's STSTokenValidator shares validation state between requests, allowing a remote unauthenticated attacker to bypass SAML assertion signature verification by reading validation results cached from other requests. The vulnerability affects CXF versions before 3.6.13, 4.0.0 through 4.1.8, and 4.2.0 through 4.2.3. Patched versions resolve the issue by isolating validation state per request.

Why it matters: Organizations running affected CXF versions face the risk of untrusted SAML assertions being accepted for authentication or authorization decisions; patching to CXF 3.6.13, 4.1.9, or 4.2.4 and later is required to close this remote exploitation path.

Source published

2026-10-09 10:23 UTC

First seen by Cybersecurity Tracker

2026-10-09 11:33 UTC