CVE-2026-88920

An authentication bypass flaw rated IMPORTANT by Red Hat affects the Apache WSS4J DOM security processor, which Red Hat ships in products including Red Hat JBoss EAP, Red Hat Single Sign-On 7.6, Red Hat JBoss Fuse 7, and the Red Hat build of Apache Camel. The vulnerability allows an unauthenticated remote attacker to bypass authentication and forge authenticated SOAP messages by submitting a crafted, unsigned SAML sender-vouches assertion containing an attacker-controlled key, enabling access to confidential data and unauthorized state-changing operations as the impersonated identity. Red Hat rated this flaw as IMPORTANT rather than the upstream CISA CRITICAL assessment (CVSS 9.8) because exploitation requires the affected service to be configured to process SAML sender-vouches assertions through the DOM security processor, a specialized, non-default WS-Security configuration. Fixes are being pursued for Red Hat JBoss EAP 8.1 and the Red Hat build of Apache Camel (Camel Quarkus 3 and Camel for Spring Boot 4.18). Red Hat JBoss EAP 7.4 and Red Hat Single Sign-On 7.6 also ship the vulnerable component, but no fix is planned for those product streams. Red Hat JBoss Fuse 7 is not affected because the vulnerable code is not in the execute path, and JBoss EAP XP 6 is not affected because the component is not present.