Patch Forecast
Amber warning
Patch this week.

CVE-2026-88920

Apache wss4j: authentication bypass

Risk score
73/100
CVSS
9.8 v3.1
Exploit chance (30 days)
0.6%
Published
30 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix…
Affected
Apache wss4j before 4.0.2, 3.0.6, 2.4.4
Fix
Upgrade Apache wss4j to 4.0.2, 3.0.6 or 2.4.4 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Apache wss4jTHE FLAWSTHE FIXCVE-2026-88920Authentication bypassCVSS 9.8 · EPSS 1%CVE-2026-89238WSS4J EncryptedHeader childconfusion could promote anattacker-controlled plaintext…CVSS 9.1 · EPSS 0%CVE-2026-87830Expression language injectionCVSS 9.1 · EPSS 0%CVE-2026-85532Improper input validationCVSS 7.5 · EPSS 1%Upgrade Apache wss4j4.0.2 · 3.0.6 · 2.4.4or later on your release lineWho is exposedApache wss4j before 4.0.2,3.0.6, 2.4.4AMBER · PATCH THIS WEEKApache wss4jAn authentication bypass in theDOM security processor inApache WSS4J allowsunauthenticated remoteattackers to forgeauthenticated SOAP messagesvia a crafted unsigned SAML…Where it standsNo known exploitationCONNECTS TOSame weaknessAuthentication bypass (CWE-287)237 other warnings in 30 days →Same productEarlier Apache wss4j warnings3 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache wss4j: Amber, patch this week. An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix…

The flaws

  • CVE-2026-88920: Authentication bypass (CVSS 9.8 · EPSS 1%)
  • CVE-2026-89238: WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the… (CVSS 9.1 · EPSS 0%)
  • CVE-2026-87830: Expression language injection (CVSS 9.1 · EPSS 0%)
  • CVE-2026-85532: Improper input validation (CVSS 7.5 · EPSS 1%)

The fix

Upgrade Apache wss4j: 4.0.2 · 3.0.6 · 2.4.4 or later on your release line

Who is exposed: Apache wss4j before 4.0.2, 3.0.6, 2.4.4

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 9.8 critical
  • Remotely exploitable without logging in

References

Original description

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Last activity 30 Sep 2026. Patch Forecast updates every hour.