CVE-2026-100227

A flaw was found in Apache CXF's JAX-RS XML Security module. The XML signature interceptors fail to properly verify that all XML content forwarded to the application is covered by the cryptographic signature. An attacker possessing any document signed by a trusted key can wrap it in unsigned...