CLEANSTART-2026-LS73465: Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays

Q: What does an attacker need to exploit this issue?

The supplied vector indicates network access is sufficient, with low attack complexity. No privileges or user interaction are required.

Q: What is the expected security impact?

The vulnerability is rated critical with a 9.1 score. It has high confidentiality and integrity impact, while availability impact is listed as none.

Q: Which deployments should be prioritized for investigation?

Prioritize deployments using the cleanstart/wso2am package where Apache CXF STSTokenValidator or Security Token Service functionality caches validated security tokens. The provided data does not identify affected versions or whether the behavior is enabled by default.

Published Nov 11, 2026

Updated

Security vulnerability affects the wso2am package. Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.

Affected Software

1 affected componentFixes available

cleanstart/wso2am<4.7.0-r5

4.7.0-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/wso2am to a version that resolves this vulnerability.
Fixed in 4.7.0-r5

Event History

Nov 11, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-97468

Frequently Asked Questions

What does an attacker need to exploit this issue?

The supplied vector indicates network access is sufficient, with low attack complexity. No privileges or user interaction are required.

What is the expected security impact?

The vulnerability is rated critical with a 9.1 score. It has high confidentiality and integrity impact, while availability impact is listed as none.

Which deployments should be prioritized for investigation?

Prioritize deployments using the cleanstart/wso2am package where Apache CXF STSTokenValidator or Security Token Service functionality caches validated security tokens. The provided data does not identify affected versions or whether the behavior is enabled by default.

CLEANSTART-2026-LS73465: Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected security impact?

Which deployments should be prioritized for investigation?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected security impact?

Which deployments should be prioritized for investigation?