CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests
Apache CXF STSTokenValidator can accept untrusted SAML assertions by sharing validation state across requests.
55
Vulnerability1 · 1 read
CVE-2026-97791
Shared-state SAML trust bypass in Apache CXF
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache CXF's STSTokenValidator stores the result of a trusted-certificate check for a SAML assertion in a single object shared by all requests. A remote, unauthenticated attacker can send a forged assertion signed with an untrusted certificate while legitimate requests are in flight and have that assertion treated as trusted without being sent to the STS. Successful abuse can bypass SAML token validation for services that rely on this validator. Only deployments that use STSTokenValidator without alwaysValidateToSts are affected. There is no known public proof of concept and no report of exploitation in the wild; the issue is fixed in 4.2.4, 4.1.9, and 3.6.13.
What to do: Upgrade Apache CXF to 4.2.4, 4.1.9, or 3.6.13. Until then, set alwaysValidateToSts so SAML assertions are always sent to the STS, and review logs for untrusted SAML assertions accepted without an STS check.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache CXF | Releases before the fixes in 3.6.13, 4.1.9, and 4.2.4, when STSTokenValidator validates SAML tokens and alwaysValidateToSts is not set |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forged assertion signed with an untrusted certificate while legitimate requests were being processed, and it could be accepted as trusted without ever reaching the STS. Only services that use STSTokenValidator to validate SAML tokens without alwaysValidateToSts set are affected. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.