Threats tagged 'cleanstart-2026-ls73465'

A critical security vulnerability in the wso2am package involves Apache CXF's STSTokenValidator and Security Token Service (STS) caching validated security tokens using a non-cryptographic 32-bit hash of the token. This flaw affects versions prior to 4.7.0-r5 and could allow attackers to compromise token validation integrity. The vulnerability has a CVSS score of 9.1, indicating high severity with network attack vector and no required privileges or user interaction. A fix is available in version 4.7.0-r5.