CVE-2026-97791
Description
A flaw was found in Apache CXF. This vulnerability allows an authentication bypass when validating Security Assertion Markup Language (SAML) tokens. Because the token validator shares validation state across concurrent requests, a remote, unauthenticated attacker can submit a forged assertion signed with an untrusted certificate while legitimate requests are processed, causing the forged assertion to be accepted as trusted.
Statement
A flaw was found in Apache CXF's STSTokenValidator, which Red Hat has rated as having Important security impact (CVSS 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). When validating SAML tokens, STSTokenValidator checks whether an assertion is signed by a trusted certificate before deciding whether to send it to the Security Token Service (STS), and that result was stored in a single object shared across all requests. As a result, one request could read another request's validation result: a remote, unauthenticated attacker could submit a forged assertion signed with an untrusted certificate while legitimate requests were being processed and have it accepted as trusted without ever reaching the STS, bypassing authentication and gaining unauthorized access to protected application data and operations. Only services that use STSTokenValidator to validate SAML tokens without alwaysValidateToSts set are affected.
Red Hat products that ship the affected Apache CXF cxf-rt-ws-security component, including Red Hat JBoss Fuse 7, Red Hat JBoss Enterprise Application Platform 7.4 and 8.1, and Red Hat build of Apache Camel, are affected, and fixes are being pursued for those streams. For certain streams, specifically Red Hat Single Sign-On 7 and particular JBoss EAP 7.4 container images, a fix will not be provided; those deployments remain exposed to the authentication bypass described above if STSTokenValidator is used without alwaysValidateToSts. JBoss EAP XP is not affected because the affected component is not present in it.
Mitigation
As a workaround, configure STSTokenValidator with alwaysValidateToSts enabled so that every incoming SAML token is always sent to the Security Token Service (STS) for validation rather than being accepted based on the local certificate-trust check; services configured this way are not exposed to the shared validation state. No other mitigation is currently available beyond this configuration change and applying updates for affected products once fixed packages are released.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.4 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | None |
| Integrity Impact | High | N/A | None |
| Availability Impact | None | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
