https://seclists.org/oss-sec/2026/q4/111: CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens

Q: Who is exposed to this issue?

Deployments using affected Apache CXF versions are exposed where STSTokenValidator or the Security Token Service caches validated security tokens. The issue applies to token types such as UsernameToken and self-signed SAML assertions.

Q: What does an attacker need to exploit the bypass?

An attacker needs to craft and present a token whose non-cryptographic 32-bit hash collides with a token already present in the validation cache. On a cache hit, the crafted token can be accepted without password validation, signature trust verification, or an STS call.

Q: What could a successful attacker do?

The attacker could authenticate as another user associated with the cached token. Through STS token validation or renewal, they could also obtain STS-signed tokens for that identity.

Q: Which versions contain the fix?

Upgrade to Apache CXF 4.2.4, 4.1.9, or 3.6.13. Affected releases are 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and releases before 3.6.13.

Published Oct 9, 2026

Updated

Affected Software

1 affected component

Apache CXF>=4.2.0<4.2.4, >=4.0.0<4.1.9, <3.6.13

Frequently Asked Questions

Who is exposed to this issue?

Deployments using affected Apache CXF versions are exposed where STSTokenValidator or the Security Token Service caches validated security tokens. The issue applies to token types such as UsernameToken and self-signed SAML assertions.

What does an attacker need to exploit the bypass?

An attacker needs to craft and present a token whose non-cryptographic 32-bit hash collides with a token already present in the validation cache. On a cache hit, the crafted token can be accepted without password validation, signature trust verification, or an STS call.

What could a successful attacker do?

The attacker could authenticate as another user associated with the cached token. Through STS token validation or renewal, they could also obtain STS-signed tokens for that identity.

Which versions contain the fix?

Upgrade to Apache CXF 4.2.4, 4.1.9, or 3.6.13. Affected releases are 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and releases before 3.6.13.