In the Apache WSS4J StAX streaming implementation, a signature reference that uses the WS‑Security STR‑Transform sets an internal "inside signed content" flag permanently. The WS‑SecurityPolicy enforcer later consults this flag to decide whether to validate remaining SignedParts and SignedElements. Because the flag remains set, the enforcer stops further checks, making a policy that requires the SOAP Body to be signed appear satisfied even when the Body lacks a signature. This bypass does not affect the cryptographic verification of signatures themselves, but it eliminates protection against XML Signature Wrapping attacks by allowing an attacker to modify the body while still passing policy checks.

The flaw impacts the streaming (StAX) component of Apache WSS4J released by the Apache Software Foundation. Versions older than 4.0.2 of the 4.x line, older than 3.0.6 of the 3.x line, and older than 2.4.4 of the 2.x line are vulnerable. The DOM-based implementation is unaffected.

An attacker who can send SOAP messages to a service that uses this library can craft a message that bypasses policy checks and performs an XML Signature Wrapping attack without needing to forge a signature. The CVSS score of 7.5 reflects the high impact of the vulnerability; however, the likelihood of exploitation cannot be quantified from the provided data. The issue is not currently listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack would be remote, requiring only network access to the application that processes signed SOAP messages.