CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests
Apache CXF STSTokenValidator can accept untrusted SAML assertions by sharing validation state across requests.
Apache CXF's STSTokenValidator stored whether a SAML assertion was signed by a trusted certificate in one object shared by all requests, so one request could read another's result. A remote unauthenticated attacker could use that to have an untrusted assertion accepted before it was sent to the STS. Affected ranges are 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and releases before 3.6.13. Apache rates CVE-2026-97791 important; the advisory does not report exploitation in the wild.
- Shared STSTokenValidator state can leak another request's SAML trust result.
- A remote unauthenticated attacker could get an untrusted assertion accepted.
- Patched in Apache CXF 3.6.13, 4.1.9, and 4.2.4.
- CVEs
- CVE-2026-97791
- Vendors
- Apache
- Products
- Apache CXF
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97791 | Shared-state SAML trust bypass in Apache CXF | 7.5 | — |
From the original article
Posted by Colm O hEigeartaigh on Oct 09 Severity: important Affected versions: - Apache CXF 4. 2. 0 before 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.