CVE-2026-92121: Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference

In Apache WSS4J’s streaming (StAX) code, a signature reference that uses the WS-Security STR-Transform leaves an internal “inside signed content” flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element still needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy that requires the SOAP Body to be signed can then be treated as satisfied even when the Body carries no signature, removing protection against XML Signature Wrapping; verification of signatures that are present is unaffected, and the DOM implementation is not affected. Applications that enforce WS-SecurityPolicy through WSS4J’s streaming path are affected and should move to 4.0.2, 3.0.6, or 2.4.4. No public proof of concept is known, the issue is not in CISA KEV, and CVSS has not yet been scored.