# CVE-2026-92121: Apache WSS4J signature verification bypass in StAX code

Source: https://junglewise.ai/threats/cve-2026-92121-in-the-wss4j-streaming-stax-code-a-signature-reference-using-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-92121 · Severity: info · Published 2026-09-30

WSS4J is a Java library that validates XML signatures in web services. A flaw in its streaming code causes it to incorrectly skip signature validation checks after processing certain signature references, allowing attackers to send SOAP messages with unsigned content that pass policy checks. This enables XML Signature Wrapping attacks where attackers modify message content while bypassing required signature protections.

Technologies: [Apache WSS4J](https://junglewise.ai/threats/technologies/apache-wss4j). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-92121 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92121 being exploited in the wild.

**How severe is CVE-2026-92121?** Informational severity, published 30 September 2026.

**Which products and versions are affected?** Apache WSS4J below 2.4.4, below 3.0.6, below 4.0.2.

**Is there a fix for CVE-2026-92121?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92121 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92121?** Check whether you run Apache WSS4J at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The StAX (streaming) implementation fails to reset an internal "inside signed content" flag after processing WS-Security STR-Transform signature references, causing the WS-SecurityPolicy enforcer to stop validating SignedParts and SignedElements for the remainder of the message. An attacker can exploit this by crafting messages where the SOAP Body lacks a required signature but still passes policy validation. The DOM-based code path is not affected; signature verification itself remains functional.

## Affected products

- Apache WSS4J below 2.4.4, below 3.0.6, below 4.0.2

## Timeline

- 2026-09-30: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/oop9p4hpl5o9byosb1qg3z7q1sgnn4pc](https://lists.apache.org/thread.html/oop9p4hpl5o9byosb1qg3z7q1sgnn4pc)

## Related threats

- [WSS4J integer overflow in DER bounds check](https://junglewise.ai/threats/cve-2026-95616-an-integer-overflow-in-wss4j-s-der-bounds-check-lets-an-oversized)
- [Apache WSS4J UsernameToken nonce replay vulnerability](https://junglewise.ai/threats/cve-2026-92899-apache-wss4j-remembers-the-nonce-of-each-usernametoken-it-accepts)
- [Apache WSS4J EncryptedHeader child confusion element promotion](https://junglewise.ai/threats/cve-2026-89238-wss4j-encryptedheader-child-confusion-could-promote-an-attacker)
- [Apache WSS4J authentication bypass in DOM security processor](https://junglewise.ai/threats/cve-2026-88920-an-authentication-bypass-in-the-dom-security-processor-in-apache)
- [Apache WSS4J derived-key bounds validation bypass](https://junglewise.ai/threats/cve-2026-85532-apache-wss4j-accepted-attacker-controlled-derived-key-lengths-and)