CLEANSTART-2026-ID16270: Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays
Published Nov 13, 2026
·Updated
Security vulnerability affects the wso2am package. Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.
Affected Software
1 affected componentFixes available
cleanstart/wso2am<4.7.0-r4
4.7.0-r4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/wso2amto a version that resolves this vulnerability.Fixed in 4.7.0-r4
Event History
Nov 13, 2026
Advisory Published
via OSV·12:36 AM
Data Sourced
via OSV·12:36 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What level of attacker access is required for exploitation?
The vector indicates the issue is remotely exploitable over the network, requires low attack complexity, and does not require privileges or user interaction.
2
What security impact can exploitation have?
The severity vector rates confidentiality and integrity impact as high. It indicates no availability impact.
3
What identifier can be used to track this vulnerability externally?
The referenced external vulnerability identifier is CVE-2026-97468.