CVE-2026-97468

Summary

Apache CXF's STS service incorrectly validates security tokens by caching them using a non-cryptographic 32-bit hash, making it vulnerable to hash collision attacks. An attacker can craft a malicious token that collides with a cached token, bypassing authentication and signature verification checks.

Exploitability

Exploitation requires crafting a token with a specific hash collision against an existing cached token, which is moderately difficult but feasible given sufficient access to the STS service and knowledge of the token structure.

Blast radius

If exploited, this vulnerability could allow attackers to impersonate any user in systems using Apache CXF's STS, potentially leading to unauthorized access to protected resources and privilege escalation through token renewal capabilities.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache CXF versions 4.2.4, 4.1.9, or 3.6.13 which contain the fix for this hash collision vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.