CVE-2026-97791

In Apache CXF , the STSTokenValidator component is vulnerable to a flaw where it shares validation state between requests. Because the result of checking whether a SAML assertion is signed by a trusted certificate is stored in a shared object, a remote, unauthenticated attacker can send a forged ...