A flaw was found in Apache WSS4J. This vulnerability in the Document Object Model (DOM) security processor allows an unauthenticated remote attacker to bypass authentication and forge authenticated Simple Object Access Protocol (SOAP) messages. An attacker can exploit this issue by submitting a crafted, unsigned Security Assertion Markup Language (SAML) sender-vouches assertion containing an attacker-controlled key.
Last checked: 2026-10-02 22:03 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-30 19:48 UTC)
Fix evidence last checked: 2026-10-02 16:54 UTC