{"affected":[{"product":"soapbar","source":"CNA: GitHub_M","vendor":"hitoshyamamoto","versions":[{"status":"affected","version":"< 0.13.0"}]}],"cveId":"CVE-2026-64855","cwes":["CWE-295","CWE-347"],"description":"soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verify_envelope_bsp() derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityToken, validated only that certificate's not-before / not-after dates, and then verified the signature against that same certificate. There was no CA-chain validation, no issuer/subject allowlist, and no pinning. A successful verify_envelope_bsp() therefore proved only that the envelope was signed by whoever supplied the embedded certificate — never that it was signed by a trusted party. An attacker who mints their own certificate, signs a forged envelope, and embeds that certificate in the token passes verification. Any consumer that treats a successful BSP verification as authentication can be impersonated (signature forgery / authentication bypass). verify_envelope() (which pins a caller-supplied x509_cert) was not affected — the flaw was specific to the BSP variant whose trust anchor came from the message. This issue has been patched in version 0.13.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},{"score":8.2,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","version":"3.1"}],"modifiedAt":1794413845370,"publishedAt":1794412096347,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/hitoshyamamoto/soapbar/security/advisories/GHSA-859w-52fx-hcm6"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/hitoshyamamoto/soapbar/pull/71"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/hitoshyamamoto/soapbar/releases/tag/v0.13.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/hitoshyamamoto/soapbar/pull/71"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/hitoshyamamoto/soapbar/releases/tag/v0.13.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/hitoshyamamoto/soapbar/security/advisories/GHSA-859w-52fx-hcm6"}],"remediation":[],"revision":"d03f77380cef79acf32821fe67a31c48202ef91e9b8501caf91c0717b66af1bd","sources":[{"modifiedAt":1794412096347,"name":"CNA: GitHub_M","retrievedAt":1794413437925,"url":"https://www.cve.org/CVERecord?id=CVE-2026-64855"},{"modifiedAt":1794413845370,"name":"NVD","retrievedAt":1794421058597,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64855"}],"ssvc":null,"status":"published","title":"soapbar: verify_envelope_bsp accepts an unauthenticated embedded certificate (signature forgery / authentication bypass)","updatedAt":1794421058597}