The vulnerability lies in the StAX streaming WS-SecurityPolicy validator, where certain relative or unsupported XPath expressions are converted into paths that never match the actual XML element path. A remote SOAP peer can exploit this flaw to send a required element without the expected signature or encryption, effectively skipping critical element‑protection checks. This allows an attacker to tamper with or forge SOAP messages while bypassing authentication or integrity checks, potentially compromising confidentiality, integrity, and availability of the system.

The issue affects the Apache WSS4J library distributed by the Apache Software Foundation, including all releases of the library that do not include the fix. Users are advised to upgrade to version 4.0.2, 3.0.6, or 2.4.4 to resolve the problem. No other specific product or platform versions are listed as affected in the current data.

Because no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the exploitation likelihood is uncertain. However, the flaw permits remote attackers to send SOAP messages that bypass signature or encryption checks, which is a high‑impact security concern. The absence of a CVSS score in the data means that the exact severity rating cannot be determined from the available information, but the nature of the vulnerability suggests a potentially serious risk if left unpatched. The attack vector is remote, using crafted SOAP messages sent over the network to the target application.