Skip to content
Heist/ feed
Medium

DEBIAN-CVE-2026-92899

Type: advisorySource: OSV1 source record

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticated request could re-send it with a space added to the Nonce: the password digest still verified, but the token no longer matched the remembered one, so the replay was accepted. Since a UsernameToken does not cover the message body, the captured token could then be reused on requests of the attacker's choosing until it expired. Affects deployments with a nonce replay cache configured, as Apache CXF has by default, and only tokens using a password digest. The cache is now keyed on the decoded Nonce. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-92899

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-92899

wss4j

Source reference: /affected/0/package/name

Affected versions
1.6.19-3

Source reference: /affected/0/versions

1.6.19-4

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

wss4j

Source reference: /affected/1/package/name

Affected versions
1.6.19-4

Source reference: /affected/1/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

wss4j

Source reference: /affected/2/package/name

Affected versions
1.6.19-4

Source reference: /affected/2/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "wss4j",
      "purl": "pkg:deb/debian/wss4j?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "1.6.19-3",
      "1.6.19-4"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-92899.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "wss4j",
      "purl": "pkg:deb/debian/wss4j?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "1.6.19-4"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-92899.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "wss4j",
      "purl": "pkg:deb/debian/wss4j?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "1.6.19-4"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-92899.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]
Related CVEs
CVE-2026-92899

Source reference: /upstream

Publisher severity

medium

Source reference: /severity/0/score

Event
#72965 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement