CVE-2026-97791

A flaw in Apache CXF 's STSTokenValidator allows for an authentication bypass during SAML token validation. The vulnerability stems from a race condition (CWE-362) where the validator shares a single object to store validation results across concurrent requests. This allows a remote, unauthentica...