Threats affecting pkg:maven/org.apache.wss4j/wss4j-ws-security-dom

CVE-2026-89238 is a critical vulnerability in Apache WSS4J that allows an attacker to exploit EncryptedHeader child confusion. This flaw can cause an attacker-controlled plaintext element to be treated as the decrypted header, resulting in incorrect confidentiality coverage and potential policy bypass. The vulnerability affects multiple versions and has been fixed in Apache WSS4J versions 4.0.2, 3.0.6, and 2.4.4.

Apache WSS4J versions prior to 4.0.2, 3.0.6, and 2.4.4 have a vulnerability in the handling of UsernameToken Nonce values. The system stored Nonce values as raw base64 text, but authentication uses decoded bytes, allowing an attacker to replay captured tokens by modifying the base64 encoding without changing the decoded value. This bypasses the nonce replay cache, enabling reuse of tokens until expiration. The issue affects deployments with nonce replay cache enabled and tokens using password digest authentication.

CVE-2026-88920 is a critical authentication bypass vulnerability in Apache WSS4J affecting the DOM security processor. It allows unauthenticated remote attackers to forge authenticated SOAP messages by using a crafted unsigned SAML sender-vouches assertion with an attacker-controlled key. This flaw enables attackers to impersonate legitimate users or services. Fixed versions are 4.0.2, 3.0.6, and 2.4.4.