CVE-2026-92899

A flaw was found in Apache WSS4J. An attacker who intercepts an authenticated request can bypass replay protection by slightly modifying the base64-encoded nonce a unique identifier used once to prevent repeated use. Because the replay cache stores the raw encoded text rather than the decoded...