# CVE-2026-88920: Apache WSS4J authentication bypass in DOM security processor

Source: https://junglewise.ai/threats/cve-2026-88920-an-authentication-bypass-in-the-dom-security-processor-in-apache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-88920 · Severity: info · Published 2026-09-30

Apache WSS4J is a security library used to process digitally signed SOAP messages in web services. An authentication bypass vulnerability allows attackers to forge authenticated SOAP messages by crafting a malicious unsigned SAML assertion, bypassing signature validation. An attacker could impersonate legitimate users or services, leading to unauthorized access to protected web services and data theft.

Technologies: [Apache WSS4J](https://junglewise.ai/threats/technologies/apache-wss4j). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-88920 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88920 being exploited in the wild.

**How severe is CVE-2026-88920?** Informational severity, published 30 September 2026.

**Which products and versions are affected?** Apache WSS4J below 2.4.4, 3.0.x below 3.0.6, 4.0.x below 4.0.2.

**Is there a fix for CVE-2026-88920?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88920 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-88920?** Check whether you run Apache WSS4J at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The DOM security processor in Apache WSS4J fails to properly validate SAML sender-vouches assertions when they contain attacker-controlled keys, allowing signature validation to be bypassed. An unauthenticated remote attacker can craft a malicious unsigned SAML assertion to forge authenticated SOAP messages. This is a network-accessible vulnerability requiring no authentication or user interaction; patches are available in versions 4.0.2, 3.0.6, and 2.4.4.

## Affected products

- Apache WSS4J below 2.4.4, 3.0.x below 3.0.6, 4.0.x below 4.0.2

## Timeline

- 2026-09-30: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9](https://lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9)

## Related threats

- [WSS4J integer overflow in DER bounds check](https://junglewise.ai/threats/cve-2026-95616-an-integer-overflow-in-wss4j-s-der-bounds-check-lets-an-oversized)
- [Apache WSS4J UsernameToken nonce replay vulnerability](https://junglewise.ai/threats/cve-2026-92899-apache-wss4j-remembers-the-nonce-of-each-usernametoken-it-accepts)
- [Apache WSS4J signature verification bypass in StAX code](https://junglewise.ai/threats/cve-2026-92121-in-the-wss4j-streaming-stax-code-a-signature-reference-using-the)
- [Apache WSS4J EncryptedHeader child confusion element promotion](https://junglewise.ai/threats/cve-2026-89238-wss4j-encryptedheader-child-confusion-could-promote-an-attacker)
- [Apache WSS4J derived-key bounds validation bypass](https://junglewise.ai/threats/cve-2026-85532-apache-wss4j-accepted-attacker-controlled-derived-key-lengths-and)