https://seclists.org/oss-sec/2026/q4/112: CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shas validation state between quests

Q: Which deployments are affected?

Only services that use STSTokenValidator to validate SAML tokens and do not have alwaysValidateToSts set are affected. Services that always validate tokens with the STS are not identified as affected.

Q: What does an attacker need to exploit this issue?

The attacker can be remote and unauthenticated. Exploitation requires sending a forged SAML assertion signed by an untrusted certificate while legitimate requests are being processed, so the shared validation state can be reused.

Q: How can the issue be mitigated if an upgrade cannot happen immediately?

Configure the service to always validate SAML tokens with the STS by setting alwaysValidateToSts. The affected behavior applies only when this setting is not enabled.

Q: Which releases contain the fix?

Upgrade to Apache CXF 4.2.4, 4.1.9, or 3.6.13. The affected ranges are 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and versions before 3.6.13.

Published Oct 9, 2026

Updated

Affected Software

1 affected component

Apache CXF>=4.2.0<4.2.4, >=4.0.0<4.1.9, <3.6.13

Frequently Asked Questions

Which deployments are affected?

Only services that use STSTokenValidator to validate SAML tokens and do not have alwaysValidateToSts set are affected. Services that always validate tokens with the STS are not identified as affected.

What does an attacker need to exploit this issue?

The attacker can be remote and unauthenticated. Exploitation requires sending a forged SAML assertion signed by an untrusted certificate while legitimate requests are being processed, so the shared validation state can be reused.

How can the issue be mitigated if an upgrade cannot happen immediately?

Configure the service to always validate SAML tokens with the STS by setting alwaysValidateToSts. The affected behavior applies only when this setting is not enabled.

Which releases contain the fix?

Upgrade to Apache CXF 4.2.4, 4.1.9, or 3.6.13. The affected ranges are 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and versions before 3.6.13.