Threats tagged 'cleanstart-2026-pp64287'

A security vulnerability in the wso2am package involves Apache CXF's STSTokenValidator, which improperly checks whether a SAML assertion is signed by a trusted certificate before sending it to the Security Token Service (STS). This flaw affects versions prior to 4.7.0-r4 and has been assigned CVE-2026-97791. The vulnerability has a high severity with a CVSS score of 7.5, primarily impacting availability. A patch is available in version 4.7.0-r4.