soapbar: Authentication bypass in verify_envelope_bsp (CVE-2026-64855)
The soapbar Python SOAP library contains an authentication bypass vulnerability in the verify_envelope_bsp function, allowing attackers to forge SOAP envelopes by using self-signed certificates.
CVE search metadata
CVE search record: CVE-2026-64855. KEV: no. Product: soapbar (< 0.13.0). Brief: soapbar: Authentication bypass in verify_envelope_bsp (CVE-2026-64855). Brief link: https://feed.craftedsignal.io/briefs/2026-11-soapbar-auth-bypass-cve-2026-64855/
Triage facts
Revision 1- Applicability
- soapbar (< 0.13.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 18:00 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The soapbar Python SOAP library contains an authentication bypass vulnerability in the verify_envelope_bsp() function (CVE-2026-64855). The function incorrectly derives trust anchors from the wsse:BinarySecurityToken within the message itself, rather than performing CA-chain validation or certificate pinning.
Impact
An attacker can supply a self-signed certificate within the SOAP message, which the library incorrectly accepts as authentic. This flaw permits attackers to forge signed SOAP envelopes, resulting in a complete bypass of authentication mechanisms relying on verify_envelope_bsp().
Recommendation
Upgrade the soapbar library to version 0.13.0 or later to ensure that trust anchors are properly validated.
Immediate actions
Inventory applications using the soapbar library and upgrade to version 0.13.0 or later.
Threat Hunt
Identify applications utilizing the verify_envelope_bsp function within the soapbar library that may be exposed to externally supplied SOAP envelopes.
Data: Application code audit logs, SOAP API request logs
Mitigations
Upgrade soapbar to version 0.13.0 or later.
CVE-2026-64855