Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-92121

In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform…

Risk score
59/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.5%
Published
30 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of…
Affected
Apache wss4j before 4.0.2, 3.0.6, 2.4.4
Fix
Upgrade Apache wss4j to 4.0.2, 3.0.6 or 2.4.4 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Apache wss4jTHE FLAWSTHE FIXCVE-2026-92121In the WSS4J streaming(StAX) code, a signaturereference using the…CVSS 7.5 · EPSS 1%CVE-2026-88920Authentication bypassCVSS 9.8 · EPSS 1%CVE-2026-89238WSS4J EncryptedHeader childconfusion could promote anattacker-controlled plaintext…CVSS 9.1 · EPSS 0%CVE-2026-87830Expression language injectionCVSS 9.1 · EPSS 0%Upgrade Apache wss4j4.0.2 · 3.0.6 · 2.4.4or later on your release lineWho is exposedApache wss4j before 4.0.2,3.0.6, 2.4.4AMBER · PATCH THIS WEEKApache wss4jAn authentication bypass in theDOM security processor inApache WSS4J allowsunauthenticated remoteattackers to forgeauthenticated SOAP messagesvia a crafted unsigned SAML…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-693 (CWE-693)60 other warnings in 30 days →Same productEarlier Apache wss4j warnings3 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache wss4j: Amber, patch this week. An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix…

The flaws

  • CVE-2026-92121: In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform… (CVSS 7.5 · EPSS 1%)
  • CVE-2026-88920: Authentication bypass (CVSS 9.8 · EPSS 1%)
  • CVE-2026-89238: WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the… (CVSS 9.1 · EPSS 0%)
  • CVE-2026-87830: Expression language injection (CVSS 9.1 · EPSS 0%)

The fix

Upgrade Apache wss4j: 4.0.2 · 3.0.6 · 2.4.4 or later on your release line

Who is exposed: Apache wss4j before 4.0.2, 3.0.6, 2.4.4

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.5 high
  • Remotely exploitable without logging in

References

Original description

In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied even when the Body carries no signature, removing the protection against XML Signature Wrapping. Signature verification itself is unaffected. The DOM code is not affected.  Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4 which fix this issue.

Last activity 30 Sep 2026. Patch Forecast updates every hour.