CVE-2026-64855 soapbar: verify_envelope_bsp accepts an unauthenticated embedded certificate (signature forgery / authentication bypass)

soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verifyenvelopebsp derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityToken, validated only that certificate's...

CVE-2026-64855

The soapbar Python SOAP library is vulnerable in versions prior to 0.13.0 due to a flaw in the verify_envelope_bsp() function. The vulnerability exists because the function derives its trust anchor directly from the message it verifies, reading an X.509 certificate from the untrusted wsse:BinaryS...