CVE-2026-88920: Apache WSS4J: SAML Sender-Vouches Authentication Bypass 

Severity: important 

Affected versions:

- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-dom) 4.0.0 before 4.0.2
- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-dom) 3.0.0 before 3.0.6
- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-dom) before 2.4.4

Description:

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key.

Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Credit:

Reported by n0mi1k (finder)

References:

https://ws.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-88920