← Back to Dashboard

CVE-2026-88920

CRITICAL NVD
CVSS Score
9.8
Severity
CRITICAL
Source
NVD
Published
Sep 30, 2026
Description

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

View Full Details ← Back