CVE-2026-92899: Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce

Apache WSS4J stored each accepted UsernameToken Nonce as raw base64 text, while authentication compared the decoded bytes. Because the same bytes can be written as base64 in more than one way, an attacker who captured a valid digest UsernameToken could add a space to the Nonce so the password digest still verified but the replay cache did not recognize the nonce. A UsernameToken does not cover the message body, so the captured token could then be replayed on requests the attacker chose until it expired. This applies only where a nonce replay cache is configured—Apache CXF enables one by default—and only to password-digest tokens. It is not listed in CISA KEV and no public proof-of-concept is known.

Upgrade Apache WSS4J to 4.0.2, 3.0.6, or 2.4.4. Prioritize services that accept WS-Security UsernameTokens with a password digest and a nonce replay cache (the default in Apache CXF), and treat captured digest tokens as reusable until they expire.