CVE-2026-97468

Apache CXF's STSTokenValidator and Security Token Service cached validated security tokens under a non-cryptographic 32-bit Java hash and treated a cache hit as proof the token had already been checked. An attacker who can present a UsernameToken or a self-signed SAML assertion whose hash collides with a cached entry is accepted without password validation, signature trust checks, or a call to the STS. That can authenticate the attacker as another user and, via STS validation or renewal, yield STS-signed tokens for that identity. Deployments that use CXF STS token validation or this cache and have not upgraded to 4.2.4, 4.1.9, or 3.6.13 are affected. There is no known public proof of concept and no report of exploitation in the wild; the issue is not on the CISA KEV list and has not yet been scored.

What to do: Upgrade Apache CXF to 4.2.4, 4.1.9, or 3.6.13 (or a later release in those lines). Until then, treat cached STS and UsernameToken/SAML validation as untrustworthy: disable or bypass the validated-token cache if your deployment allows it, require fresh password and signature checks, and review authentication logs for unexpected identities or STS-issued tokens.