CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens
Apache CXF cached validated STS tokens under a 32-bit hash, enabling authentication bypass.
Apache CXF's STSTokenValidator and Security Token Service cached validated security tokens under a non-cryptographic 32-bit hash from Java Arrays.hashCode. A cache hit was treated as proof that the presented token had already been validated, allowing an attacker to craft a colliding token and bypass authentication. Affected versions are 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and releases before 3.6.13. Apache rates CVE-2026-97468 important, and exploitation is not reported.
- Validated STS tokens were cached under a non-cryptographic 32-bit hash.
- A cache hit was treated as proof of prior validation.
- Apache rates CVE-2026-97468 important across three CXF lines.
- CVEs
- CVE-2026-97468
- Vendors
- Apache
- Products
- Apache CXF
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97468 | Auth bypass via weak STS token cache keys in Apache CXF | 9.1 | — |
From the original article
Posted by Colm O hEigeartaigh on Oct 09 Severity: important Affected versions: - Apache CXF 4. 2. 0 before 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.