8 matches found
EUVD-2026-95699
Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...
EUVD-2026-95700
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...
CVE-2026-97791
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...
CVE-2026-97468
Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...
CVE-2026-97791
In Apache CXF , the STSTokenValidator component is vulnerable to a flaw where it shares validation state between requests. Because the result of checking whether a SAML assertion is signed by a trusted certificate is stored in a shared object, a remote, unauthenticated attacker can send a forged ...
CVE-2026-97791 Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...
CVE-2026-97468
The Apache CXF framework contains an authentication bypass vulnerability in the STSTokenValidator and Security Token Service (STS) . The root cause is the use of a non-cryptographic 32-bit hash (Java Arrays.hashCode() ) to cache validated security tokens. An attacker can craft a token, such as a ...
CVE-2026-97468 Apache CXF: Authentication bypass via weak cache keys for validated STS tokens
Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...