CVE-2026-87830: Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. 

Severity: low 

Affected versions:

- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-policy-stax) 4.0.0 before 4.0.2
- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-policy-stax) 3.0.0 before 3.0.6
- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-policy-stax) before 2.4.4

Description:

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Credit:

Reported by n0mi1k (finder)

References:

https://ws.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-87830