CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens

Summary by Cyber Security News9 Oct 2026, 12:21 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/111

Posted by Colm O hEigeartaigh on Oct 09 Severity: important Affected versions: - Apache CXF 4.2.0 before 4.2.4 - Apache CXF 4.0.0 before 4.1.9 - Apache CXF before 3.6.13 Description: Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/hashCode()), and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.