CVE-2026-92121

A flaw was found in Apache WSS4J. This vulnerability allows a remote attacker to bypass security policy enforcement by submitting a specially crafted message using a Security Token Reference STR transformation. Due to an internal state tracking error in the streaming message processor, signature...