{"id":"CVE-2026-88920","title":"An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled ke…","summary":"An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled ke…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-287","CWE-347"],"vendor":"apache","product":"wss4j","affected":["wss4j < 2.4.4","wss4j >= 3.0.0, < 3.0.6","wss4j >= 4.0.0, < 4.0.2"],"patched":["wss4j 4.0.2"],"published":"2026-09-30","updated":"2026-10-02","sourceUpdated":"2026-10-02T20:17:49.397","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88920","references":[{"url":"https://lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9","label":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/10","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88920.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-88920"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543896"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88920"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88920"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00583,"epssPercentile":0.47645,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-30T19:48:23.012347Z"},"scores":{"nvd":9.8,"vendor":7.4},"ingestedAt":"2026-09-30T12:02:58.585Z","slug":"CVE-2026-88920","body":"## Overview\n\nAn authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key.\n\nUsers are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.\n\n## Affected\n\n- `wss4j < 2.4.4`\n- `wss4j >= 3.0.0, < 3.0.6`\n- `wss4j >= 4.0.0, < 4.0.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `wss4j 4.0.2`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat Single Sign-On 7 · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88920.json)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":213947,"id":"CVE-2026-88920","ts":1790799887482,"field":"cvss","old":null,"new":"9.8"},{"seq":213946,"id":"CVE-2026-88920","ts":1790799887482,"field":"severity","old":"none","new":"critical"}]}