CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens

As cited

Copy frozen at 2026-10-09 13:24 UTC (site build).

vulnerabilities

CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens

Apache CXF's Security Token Service (STS) validator cached tokens using a weak 32-bit hash function, allowing attackers to craft malicious tokens that collide with previously validated tokens and bypass authentication checks. The vulnerability affects versions 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and all versions before 3.6.13.

Why it matters: Practitioners running Apache CXF must patch immediately, as an unauthenticated attacker can forge valid security tokens through hash collision to gain unauthorized access to protected resources.

Source published

2026-10-09 10:21 UTC

First seen by Cybersecurity Tracker

2026-10-09 11:33 UTC