CVE-2026-88920: Vulnerability in Apache Software Foundation Apache WSS4J
An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
AI Analysis
Technical Summary
CVE-2026-88920 describes an authentication bypass in Apache WSS4J's DOM security processor. Attackers can exploit this vulnerability by crafting an unsigned SAML sender-vouches assertion containing a key they control, enabling them to forge authenticated SOAP messages without proper authentication. This compromises the integrity of SOAP message authentication. The vulnerability affects versions 4.0.0 up to but not including 4.0.2, 3.0.0 up to but not including 3.0.6, and all versions prior to 2.4.4. Upgrading to fixed versions 4.0.2, 3.0.6, or 2.4.4 mitigates the issue.
Potential Impact
The vulnerability allows unauthenticated remote attackers to bypass authentication controls in the SOAP message processing, potentially enabling them to impersonate legitimate senders by forging authenticated messages. This could lead to unauthorized actions or access in systems relying on Apache WSS4J for SOAP message security.
Mitigation Recommendations
Users should upgrade Apache WSS4J to version 4.0.2, 3.0.6, or 2.4.4 or later, as these versions contain fixes for this authentication bypass vulnerability. No other mitigation steps are indicated by the vendor advisory.
CVE-2026-88920: Vulnerability in Apache Software Foundation Apache WSS4J
Description
An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Affected software
Apache Software Foundation
Apache WSS4J
pkg:maven/Apache Software Foundation/org.apache.wss4j:wss4j-ws-security-domRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-88920 describes an authentication bypass in Apache WSS4J's DOM security processor. Attackers can exploit this vulnerability by crafting an unsigned SAML sender-vouches assertion containing a key they control, enabling them to forge authenticated SOAP messages without proper authentication. This compromises the integrity of SOAP message authentication. The vulnerability affects versions 4.0.0 up to but not including 4.0.2, 3.0.0 up to but not including 3.0.6, and all versions prior to 2.4.4. Upgrading to fixed versions 4.0.2, 3.0.6, or 2.4.4 mitigates the issue.
Potential Impact
The vulnerability allows unauthenticated remote attackers to bypass authentication controls in the SOAP message processing, potentially enabling them to impersonate legitimate senders by forging authenticated messages. This could lead to unauthorized actions or access in systems relying on Apache WSS4J for SOAP message security.
Mitigation Recommendations
Users should upgrade Apache WSS4J to version 4.0.2, 3.0.6, or 2.4.4 or later, as these versions contain fixes for this authentication bypass vulnerability. No other mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-09-10T13:32:10.370Z
- State
- PUBLISHED
Threat ID: 6abcfcc40df196e1a9fc0dd7
Added to database: 09/30/2026, 12:12:52 UTC
Last enriched: 09/30/2026, 12:27:04 UTC
Last updated: 09/30/2026, 13:03:41 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.