CVE-2026-97791: Vulnerability in Apache Software Foundation Apache CXF
Description
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forged assertion signed with an untrusted certificate while legitimate requests were being processed, and it could be accepted as trusted without ever reaching the STS. Only services that use STSTokenValidator to validate SAML tokens without alwaysValidateToSts set are affected. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Affected software
Apache Software Foundation
Apache CXF
pkg:maven/Apache Software Foundation/org.apache.cxf:cxf-rt-ws-securityRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Apache CXF, the STSTokenValidator improperly shares the validation result of SAML assertions across requests by storing it in a shared object. This flaw allows a remote unauthenticated attacker to submit a forged SAML assertion signed with an untrusted certificate, which could be mistakenly accepted as trusted if processed concurrently with legitimate requests. The vulnerability only affects services that use STSTokenValidator without the alwaysValidateToSts configuration enabled. The issue is resolved in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.
Potential Impact
A remote unauthenticated attacker can exploit this vulnerability to have a forged SAML assertion accepted as trusted by the service, bypassing the intended validation process that involves the Security Token Service (STS). This could lead to unauthorized access or privilege escalation in affected services that rely on STSTokenValidator for SAML token validation without alwaysValidateToSts set.
Mitigation Recommendations
Users should upgrade Apache CXF to versions 4.2.4, 4.1.9, or 3.6.13 where this vulnerability is fixed. No other mitigations are indicated. The vendor advisory confirms these versions as the official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-09-25T04:38:00.142Z
- State
- PUBLISHED
Threat ID: 6ac8c3212cdf04f6564c0d24
Added to database: 10/09/2026, 10:34:09 UTC
Last enriched: 10/09/2026, 10:48:54 UTC
Last updated: 10/09/2026, 18:57:32 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.