Apache WSS4J stores the Nonce of each UsernameToken as the raw base64 text it receives. During authentication it decodes that text to bytes and uses those bytes for password digest verification. Because the same byte sequence can be encoded in base64 in several different ways, an attacker who captures a legitimate request can alter the Nonce—by inserting whitespace or using an alternative base64 representation—while keeping the decoded bytes identical. The decoded bytes still validate the password digest, but the cache key, now based on the decoded bytes, no longer matches the remembered value, so the replay protection is bypassed. This allows the attacker to reuse the captured UsernameToken on subsequent requests until the token expires, and because the token does not cover the message body, the attacker can execute arbitrary authenticated operations until the token is revoked or expires.

The flaw affects deployments of Apache WSS4J that employ a nonce replay cache, such as the default configuration in Apache CXF, and where UsernameTokens are constructed with a password digest. Versions earlier than 4.0.2, 3.0.6, or 2.4.4 are vulnerable. Updating to the patched releases is the recommended remediation.

The CVSS score of 4.8 indicates moderate risk severity. The EPSS score is less than 1%, reflecting a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack requires only a single interception of a legitimate authenticated request and minimal alteration of the nonce representation, making it a straightforward network-based replay attack that can grant unauthorized authenticated access until the token expires.