CVE-2026-97791 in CXF
Summary
by MITRE • 10/09/2026
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forged assertion signed with an untrusted certificate while legitimate requests were being processed, and it could be accepted as trusted without ever reaching the STS. Only services that use STSTokenValidator to validate SAML tokens without alwaysValidateToSts set are affected. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability in Apache CXF stems from a critical race condition within the STSTokenValidator component, specifically affecting how SAML assertion signatures are validated against trusted certificates before being forwarded to the Security Token Service. The core technical flaw lies in the use of a shared object state that is not properly isolated between concurrent requests. When multiple threads process incoming security tokens simultaneously, they interact with this common storage mechanism without adequate synchronization or isolation mechanisms. Consequently, the validation result computed for one request can be inadvertently read by another distinct request due to this lack of thread safety. This architectural oversight creates a window where the integrity of the authentication decision is compromised because the state reflecting whether an assertion was signed by a trusted certificate becomes unreliable and potentially contaminated by concurrent operations from unrelated users or services.
From an operational perspective, this flaw allows for a sophisticated remote attack vector that does not require prior authentication. An attacker can craft a malicious SAML assertion signed with an untrusted certificate and submit it to the vulnerable service endpoint. By carefully timing their request relative to legitimate traffic processing by other users, the attacker can exploit the race condition such that their forged assertion is accepted as valid. This occurs because the shared object may return validation results intended for another user or a previous state rather than reflecting the actual cryptographic verification of the current token. As a result, an unauthenticated actor gains unauthorized access to protected resources by bypassing the expected trust chain verification logic without ever successfully interacting with the STS itself in a manner that would normally reject such invalid credentials.
The impact is particularly severe for services configured to use STSTokenValidator while having alwaysValidateToSts set to false, as these configurations rely entirely on this local validation step before proceeding. The ability to bypass signature verification effectively undermines the foundational principles of SAML-based single sign-on and federated identity management within Apache CXF deployments. Attackers can impersonate legitimate users or access sensitive data by presenting forged tokens that appear valid due to the race condition, leading to potential unauthorized data exposure, privilege escalation, and complete compromise of application security controls dependent on accurate token validation.
To mitigate this vulnerability, organizations must upgrade their Apache CXF installations immediately to version 4.2.4, 4.1.9, or 3.6.13, where the shared state handling has been corrected to ensure thread safety and proper isolation of request-specific data. In environments where upgrading is not immediately feasible, administrators should consider setting alwaysValidateToSts to true if supported by their specific configuration, forcing validation through the STS which may have more robust security controls. Additionally, implementing strict rate limiting on authentication endpoints can reduce the likelihood of successful race condition exploitation by making it harder for attackers to synchronize their malicious requests with legitimate traffic patterns. This issue is categorized under CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization and aligns with ATT&CK techniques related to privilege escalation and bypassing access controls through authentication manipulation.