CVE-2026-92121 Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference
Attackers can bypass WS-SecurityPolicy signature checks in Apache WSS4J streaming code, allowing unsigned SOAP bodies to pass validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92121?
CVE-2026-92121 is a high-severity vulnerability in Apache WSS4J, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied even when the Body carries no signature, removing the protection against XML Signature Wrapping. Signature verification itself is unaffected. The DOM code is not affected. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4 which fix this issue.
Weakness: CWE-693
Which versions are affected by CVE-2026-92121?
It affects 1 product.
Products include Apache Wss4j.
How do I fix CVE-2026-92121?
Upgrade to a fixed version.
Is CVE-2026-92121 being exploited?
There is no known exploitation of CVE-2026-92121 in the wild and no public exploit code.
Other vulnerabilities in Apache WSS4J
- CVE-2026-88920 Apache WSS4J: SAML Sender-Vouches Authentication Bypass
- CVE-2026-87830 Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.
- CVE-2026-89238 Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection
- CVE-2026-85532 Apache WSS4J: Insufficient Validation of Derived-Key Parameters
- CVE-2026-95616 Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions
Sources
Also known as DEBIAN-CVE-2026-92121, GHSA-877v-57rx-34hv, RHLW-2026-422078e03066e6ac, UBUNTU-CVE-2026-92121.