CVE-2026-97468

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13

Description The STSTokenValidator and Security Token Service (STS) cache validated security tokens using a non-cryptographic 32-bit hash generated by Java Arrays.hashCode/hashCode(). Because the system treats a cache hit as confirmation that a token has been validated, an attacker can create a token, such as a self-signed SAML Assertion or a UsernameToken, that produces a hash colliding with an existing cached entry. This allows the attacker to bypass password validation, signature trust verification, or STS calls, enabling them to authenticate as another user and potentially obtain STS-signed tokens for that identity.

Recommendations Upgrade to version 4.2.4. Upgrade to version 4.1.9. Upgrade to version 3.6.13.