CVEvulnerability
CVE-2026-97468
9.1 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2026-10-09
- Last modified
- 2026-10-20
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-328
Description
Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/hashCode()), and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token (for example a UsernameToken or a self-signed SAML Assertion) whose hash collides with a cached entry. The token would then be accepted without password validation, signature trust verification or a call to the STS. This could let the attacker authenticate as another user and, through STS token validation or renewal, obtain STS-signed tokens for that identity.
Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Affected configurations
• apache cxf (< 3.6.13)
• apache cxf (>= 4.0.0 < 4.1.9)
• apache cxf (>= 4.2.0 < 4.2.4)
Related
Weakness · CWE (1)
- CWE-328 Use of Weak Hash weakness
References
- https://lists.apache.org/thread.html/qthbnsyhqsxhl9p2h9v5dg4mnwv1b9r6 Issue Tracking, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/09/9 Mailing List, Third Party Advisory