CVE-2026-97791

Summary

The flaw is a race condition in Apache CXF's STSTokenValidator where shared state between concurrent requests allows one request to incorrectly validate a forged SAML assertion as trusted, potentially bypassing security controls. This affects services using SAML token validation without alwaysValidateToSts set.

Exploitability

Exploitation is relatively straightforward for unauthenticated remote attackers who can submit forged SAML assertions signed with untrusted certificates while legitimate requests are being processed, requiring no authentication or special privileges.

Blast radius

The impact could be significant across all services using affected Apache CXF versions with STS token validation, potentially allowing unauthorized access to protected resources by accepting forged tokens without proper validation.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache CXF versions 4.2.4, 4.1.9, or 3.6.13 which contain the fix for this race condition in STSTokenValidator.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.