CVE-2026-92899

Name of the Vulnerable Software and Affected Versions Apache WSS4J versions prior to 4.0.2 Apache WSS4J versions prior to 3.0.6 Apache WSS4J versions prior to 2.4.4

Description An issue exists in the handling of the Nonce within the UsernameToken. The software stores the Nonce as raw base64 text, while the authentication process decodes this text to use the underlying bytes. Because the same bytes can be represented as base64 in multiple ways, an attacker can capture an authenticated request and resend it with a space added to the Nonce. This bypasses the replay cache because the modified token does not match the stored raw text, even though the password digest remains valid. Since the UsernameToken does not cover the message body, the captured token can be reused for arbitrary requests until it expires. This affects deployments using a password digest and a configured nonce replay cache, which is the default configuration for Apache CXF.

Recommendations Upgrade to version 4.0.2. Upgrade to version 3.0.6. Upgrade to version 2.4.4.