Threats affecting pkg:maven/org.apache.wss4j/wss4j

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.8	EPSS 0.6%	CVE-2026-88920Apache WSS4J · Authentication Bypass Critical9.8EPSS 0.6%2026-09-30GCVE DatabaseCVE-2026-88920 CVE-2026-88920 is a critical authentication bypass vulnerability in the DOM security processor of Apache WSS4J. It enables unauthenticated remote attackers to forge authenticated SOAP messages by exploiting a crafted unsigned SAML sender-vouches assertion with an attacker-controlled key. This vulnerability is fixed in Apache WSS4J versions 4.0.2, 3.0.6, and 2.4.4. EPSS 0.6%Report on CVE-2026-88920 Vulnerability CWE-287 #ghsa-4c9g-74h5-78r7	GCVE Database	2026-09-30

Page 1 of 1