Patch Forecast
Amber warning
Patch this week.

CVE-2026-89238

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the…

Risk score
63/100
CVSS
9.1 v3.1
Exploit chance (30 days)
0.3%
Published
30 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Affected
Apache wss4j before 4.0.2, 3.0.6, 2.4.4
Fix
Upgrade Apache wss4j to 4.0.2, 3.0.6 or 2.4.4 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Apache wss4jTHE FLAWSTHE FIXCVE-2026-89238WSS4J EncryptedHeader childconfusion could promote anattacker-controlled plaintext…CVSS 9.1 · EPSS 0%CVE-2026-88920Authentication bypassCVSS 9.8 · EPSS 1%CVE-2026-87830Expression language injectionCVSS 9.1 · EPSS 0%CVE-2026-85532Improper input validationCVSS 7.5 · EPSS 1%Upgrade Apache wss4j4.0.2 · 3.0.6 · 2.4.4or later on your release lineWho is exposedApache wss4j before 4.0.2,3.0.6, 2.4.4AMBER · PATCH THIS WEEKApache wss4jAn authentication bypass in theDOM security processor inApache WSS4J allowsunauthenticated remoteattackers to forgeauthenticated SOAP messagesvia a crafted unsigned SAML…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-345 (CWE-345)45 other warnings in 30 days →Same productEarlier Apache wss4j warnings3 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache wss4j: Amber, patch this week. An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix…

The flaws

  • CVE-2026-89238: WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the… (CVSS 9.1 · EPSS 0%)
  • CVE-2026-88920: Authentication bypass (CVSS 9.8 · EPSS 1%)
  • CVE-2026-87830: Expression language injection (CVSS 9.1 · EPSS 0%)
  • CVE-2026-85532: Improper input validation (CVSS 7.5 · EPSS 1%)

The fix

Upgrade Apache wss4j: 4.0.2 · 3.0.6 · 2.4.4 or later on your release line

Who is exposed: Apache wss4j before 4.0.2, 3.0.6, 2.4.4

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 9.1 critical
  • Remotely exploitable without logging in

References

Original description

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Last activity 30 Sep 2026. Patch Forecast updates every hour.