Description
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forged assertion signed with an untrusted certificate while legitimate requests were being processed, and it could be accepted as trusted without ever reaching the STS. Only services that use STSTokenValidator to validate SAML tokens without alwaysValidateToSts set are affected. 
Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Published: 2026-10-09
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access
Action: Immediate Patch
AI Analysis

Impact

The vulnerability arises from shared state in STokenValidator in Apache CXF where the result of a signature verification is stored in a shared object across requests. An attacker can send a forged SAML assertion signed with an untrusted certificate while a legitimate request is being processed. Because the verifier reads an earlier trusted result from the shared object, the forged assertion is incorrectly treated as trusted, bypassing the STS and potentially granting unauthorized access.

Affected Systems

The issue affects Apache CXF versions 3.x and 4.x that use STSTokenValidator with the alwaysValidateToSts flag disabled. Specifically, affected releases include 3.6.12 and earlier, 4.1.8 and earlier, and 4.2.3 and earlier. Users should verify the version of Apache CXF in their deployments and determine if the component is configured to rely on STSTokenValidator without alwaysValidateToSts. The patch releases, 3.6.13, 4.1.9, and 4.2.4, address the bug.

Risk and Exploitability

The vulnerability is exploitable remotely without authentication and does not involve privilege escalation or arbitrary code execution. The CVSS score is 7.4, indicating high severity. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers would likely target services exposing SAML token validation such as web services or single sign‑on gateways by sending crafted SAML assertions during concurrent legitimate traffic.

Generated by OpenCVE AI on October 10, 2026 at 04:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache CXF to at least 4.2.4, 4.1.9, or 3.6.13, the releases that contain the fix.
  • Configure STSTokenValidator with alwaysValidateToSts set to true, ensuring each token is sent to the STS for validation on every request.
  • Replace the affected CXF components with newer versions that isolate validation state per request, or apply the vendor's security patch if an upgrade is not yet possible.

Generated by OpenCVE AI on October 10, 2026 at 04:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*

Thu, 15 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Sat, 10 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-363

Sat, 10 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-488
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

threat_severity

Important

Fri, 09 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache cxf
Vendors & Products Apache
Apache cxf

Fri, 09 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-363

Fri, 09 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
References

Fri, 09 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Description In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forged assertion signed with an untrusted certificate while legitimate requests were being processed, and it could be accepted as trusted without ever reaching the STS. Only services that use STSTokenValidator to validate SAML tokens without alwaysValidateToSts set are affected.  Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Title Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests
References

Subscriptions

Apache Cxf
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-15T17:32:09.718Z

Reserved: 2026-09-25T04:38:00.142Z

Link: CVE-2026-97791

cve-icon Vulnrichment

Updated: 2026-10-09T11:08:04.093Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-09T11:17:03.380

Modified: 2026-10-20T12:38:56.460

Link: CVE-2026-97791

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-09T10:19:26Z

Links: CVE-2026-97791 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-10T04:30:17Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-488

    Exposure of Data Element to Wrong Session