# CVE-2026-97791: Apache CXF STSTokenValidator SAML validation cache-based bypass

Source: https://junglewise.ai/threats/cve-2026-97791-in-apache-cxf-ststokenvalidator-checks-whether-a-saml-assertion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-97791 · Severity: high · CVSS 7.5 · Published 2026-10-09

Apache CXF is a web services framework used to build secure messaging and token validation services. The STSTokenValidator component improperly caches SAML token validation results in shared memory, allowing an attacker to submit a forged token with an untrusted signature that gets reused for legitimate requests, bypassing authentication. This could lead to unauthorized access to services relying on this validation mechanism.

## Quick answers

**Is CVE-2026-97791 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97791 being exploited in the wild.

**How severe is CVE-2026-97791?** High severity, with a CVSS score of 7.5, published 9 October 2026.

**Which products and versions are affected?** Apache CXF before 3.6.13, 4.1.9, 4.2.4.

**Is there a fix for CVE-2026-97791?** Yes: fixed in Apache CXF 3.6.13, 4.1.9, 4.2.4. Until then: Ensure the alwaysValidateToSts configuration option is enabled for STSTokenValidator to prevent cached validation results from being trusted without STS verification. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97791 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-97791?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Apache CXF 3.6.13, 4.1.9, 4.2.4

Ensure the alwaysValidateToSts configuration option is enabled for STSTokenValidator to prevent cached validation results from being trusted without STS verification.

## Technical details

STSTokenValidator caches SAML assertion validation results in an object shared across all requests, creating a race condition where one request's validation outcome can be read by another. An unauthenticated remote attacker can send a malformed SAML assertion signed with an untrusted certificate; if processed during concurrent legitimate requests, the cached result bypasses signature verification and prevents the assertion from reaching the Security Token Service. Only deployments using STSTokenValidator without alwaysValidateToSts enabled are vulnerable.

## Affected products

- Apache CXF before 3.6.13, 4.1.9, 4.2.4

## Timeline

- 2026-10-09: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/ssdr417qgms9fjl0m8802xd8170wnk1l](https://lists.apache.org/thread.html/ssdr417qgms9fjl0m8802xd8170wnk1l)