{"schema_version": "1.6.1", "id": "CVE-2026-88920", "summary": "SAML Sender-Vouches Authentication Bypass", "details": "An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key.\n\nUsers are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "4.0.0"}, {"fixed": "4.0.2"}]}, {"type": "SEMVER", "events": [{"introduced": "3.0.0"}, {"fixed": "3.0.6"}]}, {"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "2.4.4"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9"}]}