CVE-2026-88920CWE-287

CVE-2026-88920

Critical · published September 30, 2026

CVSS v3.1

9.8

EPSS

Percentile

46.5

In the wild

Unconfirmed

What it is

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key.

Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

The record

Technical detail

CVSS v3.1: 9.8 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00571 · 46.5th percentile
Weakness: CWE-287 · Improper Authentication
Published: 2026-09-30T16:17Z

Affected products (3)

Product	Versions	Fixed in
apache/wss4j	< 2.4.4	2.4.4
apache/wss4j	≥ 3.0.0, < 3.0.6	3.0.6
apache/wss4j	≥ 4.0.0, < 4.0.2	4.0.2

References (2)

https://lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9 · [email protected]http://www.openwall.com/lists/oss-security/2026/09/30/10 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

02 OCT 03:46Z
EPSS moved — → 1%
epss
30 SEP 11:58Z
Apache WSS4J: SAML Sender-Vouches Authentication Bypass
cvelistv5