Wss4jSecurityInterceptor fails to wire Apache WSS4J ReplayCache in certain request paths, so UsernameToken nonces, timestamps, Timestamp elements, and SAML one‑time‑use tokens lose their intended replay protection. An attacker who can replay a previously intercepted message can perform a replay attack that may lift authentication checks or replay privileged operations, thereby compromising integrity and authentication. This weakness falls under CWE-294.

Spring Web Services 3.1.0 to 3.1.8, 4.0.0 to 4.0.18, 4.1.0 to 4.1.3, and 5.0.0 to 5.0.1 are affected. These are part of the Spring Framework used to build web‑service applications that rely on the Wss4jSecurityInterceptor for security.

The CVSS score of 3.7 indicates a low severity; the EPSS score is not available and the vulnerability is not in the CISA KEV catalog, suggesting limited exploitation data. The likely attack vector is remote, via SOAP or REST endpoints that use the interceptor. Exploitation requires sending a replayed message with a valid UsernameToken or SAML token; if the ReplayCache is not wired, the server will accept the duplicate, giving the attacker the ability to repeat a privileged operation. Because it depends on specific interceptor wiring, successful exploitation may require configuration knowledge, reducing the overall risk.