CVE-2026-97791

HighCVSS 7.5/10Last modified Oct 20, 2026

Description

In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forged assertion signed with an untrusted certificate while legitimate requests were being processed, and it could be accepted as trusted without ever reaching the STS. Only services that use STSTokenValidator to validate SAML tokens without alwaysValidateToSts set are affected.  Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Oct 9, 2026
Last modified
Oct 20, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-977927.8Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges loCVE-2026-977937.0Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.CVE-2026-977947.8Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privilegesCVE-2026-977987.8Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker CVE-2026-977997.8Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.CVE-2026-97808.8Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypCVE-2026-978007.8Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locallCVE-2026-978017.5Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.CVE-2026-978037.8Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-978047.8Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.CVE-2026-978059.8Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.CVE-2026-978067.8Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.