CVE-2026-92121

Summary

WSS4J streaming code has a flaw where signature references using WS-Security STR-Transform leave an internal flag permanently set, causing the policy enforcer to skip checking subsequent signed elements even when they should be validated. This allows attackers to bypass SOAP Body signing requirements and enables XML Signature Wrapping attacks without detection.

Exploitability

Exploitation requires a malicious SOAP message with a STR-Transform signature reference that triggers the flag-setting behavior, but no public exploit is available yet and the attack vector is limited to WSS4J streaming processing.

Blast radius

The vulnerability affects systems using Apache WSS4J streaming (StAX) for WS-Security processing, potentially allowing attackers to bypass critical message integrity protections in web services that require signed SOAP bodies.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache WSS4J versions 4.0.2, 3.0.6, or 2.4.4 which contain the fix for this issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.