CLEANSTART-2026-ES04203: In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS

Q: What access does an attacker need to exploit this issue?

The supplied severity vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the expected security impact?

The supplied vector indicates an availability impact of high, with no indicated confidentiality or integrity impact. Scope is listed as unchanged.

Q: Which package should be investigated?

The affected software identifier is cleanstart/wso2am, and the description identifies the wso2am package.

Published Nov 11, 2026

Updated

Security vulnerability affects the wso2am package. In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS.

Affected Software

1 affected componentFixes available

cleanstart/wso2am<4.7.0-r5

4.7.0-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/wso2am to a version that resolves this vulnerability.
Fixed in 4.7.0-r5

Event History

Nov 11, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-97791

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The supplied severity vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the expected security impact?

The supplied vector indicates an availability impact of high, with no indicated confidentiality or integrity impact. Scope is listed as unchanged.

Which package should be investigated?

The affected software identifier is cleanstart/wso2am, and the description identifies the wso2am package.

CLEANSTART-2026-ES04203: In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected security impact?

Which package should be investigated?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected security impact?

Which package should be investigated?