---
id: CVE-2026-88920
title: >-
  An authentication bypass in the DOM security processor in Apache WSS4J allows
  unauthenticated remote attackers to forge authenticated SOAP messages via a
  crafted unsigned SAML sender-vouches assertion containing an
  attacker-controlled ke…
summary: >-
  An authentication bypass in the DOM security processor in Apache WSS4J allows
  unauthenticated remote attackers to forge authenticated SOAP messages via a
  crafted unsigned SAML sender-vouches assertion containing an
  attacker-controlled ke…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-287
  - CWE-347
vendor: apache
product: wss4j
affected:
  - wss4j < 2.4.4
  - 'wss4j >= 3.0.0, < 3.0.6'
  - 'wss4j >= 4.0.0, < 4.0.2'
patched:
  - wss4j 4.0.2
published: '2026-09-30'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T20:17:49.397'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88920'
references:
  - url: 'https://lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/30/10'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88920.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-88920'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2543896'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-88920'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88920'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00583
epssPercentile: 0.47645
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-30T19:48:23.012347Z'
scores:
  nvd: 9.8
  vendor: 7.4
ingestedAt: '2026-09-30T12:02:58.585Z'
---

## Overview

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key.

Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

## Affected

- `wss4j < 2.4.4`
- `wss4j >= 3.0.0, < 3.0.6`
- `wss4j >= 4.0.0, < 4.0.2`

## Remediation

Upgrade past the affected range:

- `wss4j 4.0.2`

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat Single Sign-On 7 · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88920.json)