The flaw resides in the StAX streaming WS‑SecurityPolicy validator, where certain relative or unsupported XPath expressions are transformed into paths that never match the real XML element path. As stated, a remote SOAP peer can therefore deliver a required element without the expected signature or encryption, allowing the attacker to send tampered or forged SOAP messages while avoiding the intended integrity checks.

The vulnerability affects all versions of the Apache WSS4J library distributed by the Apache Software Foundation that lack the fix. The advisory recommends upgrading to version 4.0.2, 3.0.6, or 2.4.4, which contain the necessary code changes.

The CVSS score of 9.1 indicates critical severity and reflects the potential for remote attackers to subvert signature or encryption verification. EPSS data is not available, so the concrete likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote and requires sending crafted SOAP messages over the network to a target application that uses the affected library.