SOAP Library Vulnerability in Python Product from Hitoshiyamamoto
CVE-2026-64855
8.2HIGH
What is CVE-2026-64855?
The soapbar library for Python, prior to version 0.13.0, included a significant vulnerability in its verify_envelope_bsp() function. This flaw allowed attackers to manipulate the trust anchor derived from untrusted sources such as wsse:BinarySecurityToken. Since validation was solely based on the certificate's active dates without validating the certificate authority chain, any forged certificate could potentially authenticate a malicious actor, compromising the integrity of the SOAP messages. Consumers treating verification success as authentication risk impersonation attacks. This serious threat has been addressed in version 0.13.0.
Affected Version(s)
soapbar < 0.13.0