Nonce Replay Vulnerability in Apache WSS4J Product from Apache
CVE-2026-92899

4.8MEDIUM

Key Information:

Vendor

Apache
Status
Apache Wss4j
Vendor
CVE Published:
30 September 2026

What is CVE-2026-92899?

Apache WSS4J is susceptible to a nonce replay vulnerability due to improper handling of UsernameToken Nonces. When a captured UsernameToken is re-sent with an altered Nonce, the system incorrectly validates the password digest, allowing an attacker to reuse the token for unauthorized requests until it expires. This issue primarily affects deployments configured with a nonce replay cache (which is default in Apache CXF) and only impacts tokens utilizing a password digest for authentication. Users are strongly advised to update to versions 4.0.2, 3.0.6, or 2.4.4, which provide critical fixes for this vulnerability.

Affected Version(s)

Apache WSS4J 4.0.0 < 4.0.2

Apache WSS4J 3.0.0 < 3.0.6

Apache WSS4J 0 < 2.4.4

References

https://lists.apache.org/thread.html/nrzngsz1xm2lztq3t873...
vendor-advisory

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Reported by n0mi1k
.