In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forged assertion signed with an untrusted certificate while legitimate requests were being processed, and it could be accepted as trusted without ever reaching the STS. Only services that use STSTokenValidator to validate SAML tokens without alwaysValidateToSts set are affected.
Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread.html/ssdr417qgms9fjl0m8802xd8170wnk1l | Issue Tracking Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/10/09/10 | Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
20 Oct 2026, 12:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.apache.org/thread.html/ssdr417qgms9fjl0m8802xd8170wnk1l - Issue Tracking, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/10/09/10 - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* | |
| First Time |
Apache cxf
Apache |
15 Oct 2026, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-362 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
09 Oct 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
09 Oct 2026, 11:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-09 11:17
Updated : 2026-10-20 12:38
NVD link : CVE-2026-97791
Mitre link : CVE-2026-97791
CVE.ORG link : CVE-2026-97791
JSON object : View
Products Affected
apache
- cxf
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')