Apache WSS4J CVE-2026-89238

Requires the target to run a SOAP/web-services endpoint using Apache WSS4J (in an affected range: 4.0.0<4.0.2, 3.0.0<3.0.6, or <2.4.4) for WS-Security processing that decrypts EncryptedHeader elements and enforces WS-SecurityPolicy - commonly via Apache CXF-based services. The attacker sends a crafted SOAP message with confused EncryptedHeader child structure; no authentication (PR:N) and no user interaction (UI:N) are needed. Exploitation is limited to deployments that actually rely on encrypted SOAP headers/policy enforcement - services not using WS-Security header confidentiality are not meaningfully exposed.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1) describes a network-reachable, low-complexity, unauthenticated flaw in Apache WSS4J's WS-Security processing, and this is internally consistent with the description: an attacker who can submit a crafted SOAP message can exploit EncryptedHeader child confusion so that an attacker-controlled plaintext element is promoted as the decrypted header, undermining confidentiality coverage and enabling WS-SecurityPolicy bypass. The C:H/I:H rating is defensible - a confidentiality-coverage bypass means data assumed protected is not, and policy bypass can let a message pass security enforcement it should have failed, affecting integrity of the security decision. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so despite the 9.1 this should be treated as a high-severity-but-not-yet-actively-exploited issue rather than an imminent mass-exploitation threat. The realistic risk is gated by deployment: WSS4J is a library, so only services that actually consume it for WS-Security header decryption/policy enforcement are exposed. Note the 'Authentication Bypass' tag overstates the flaw - the description frames it as confidentiality-coverage and security-policy bypass (CWE-345, insufficient verification of data authenticity), not credential/authentication bypass.

An attacker crafts a malicious SOAP request to a public web service built on Apache WSS4J (e.g., via Apache CXF), structuring EncryptedHeader child elements so that an attacker-controlled plaintext element is mistaken for the legitimately decrypted header. The service then treats unencrypted, attacker-supplied content as satisfying its confidentiality/security policy, allowing the message to bypass enforcement without authentication. No public proof-of-concept is identified in the provided data, but the network/low-complexity/no-privilege vector makes crafting such a message straightforward for an attacker who understands WS-Security.