News · via oss-security
CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests
Posted by Colm O hEigeartaigh on Oct 09 Severity: important Affected versions: - Apache CXF 4.2.0 before 4.2.4 - Apache CXF 4.0.0 before 4.1.9 - Apache CXF before 3.6.13 Description: In Apache CXF…