CVE-2026-97791

HIGH 7.5

Published 2026-10-09 · Last modified 2026-10-15

In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forged assertion signed with an untrusted certificate while legitimate requests were being processed, and it could be accepted as trusted without ever reaching the STS. Only services that use STSTokenValidator to validate SAML tokens without alwaysValidateToSts set are affected. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 15th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

7.5CVSS 3.1 · HIGH

ConfidentialityNone
IntegrityNone
AvailabilityHigh

What an attacker needs

✓Access: Reachable over the network — no local access needed
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

github-search Search GitHub for public PoC repos

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-97791/poc.jsonMachine-readable PoC index for this CVE (for automation).

Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-97791/poc.json

Affected

Vendors Apache Software Foundation Apache

Products Apache Cxf Cxf

Weakness (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Known Affected Software Configurations

Vendor	Product	Version range
Apache	Cxf	< 3.6.13
Apache	Cxf	≥ 4.0.0 and < 4.1.9
Apache	Cxf	≥ 4.2.0 and < 4.2.4

All CVSS metrics

HIGH 7.5 v3.1 · ADP Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
HIGH 7.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Advisories

https://lists.apache.org/thread.html/ssdr417qgms9fjl0m8802xd8170wnk1l vendor-advisoryIssue TrackingVendor Advisory
http://www.openwall.com/lists/oss-security/2026/10/09/10 Mailing ListThird Party Advisory

Sources: NVD · CVE.org · EPSS