Soapbar - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/soapbar/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 18:00:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgsoapbar: Authentication bypass in verify_envelope_bsp (CVE-2026-64855)https://feed.craftedsignal.io/briefs/2026-11-soapbar-auth-bypass-cve-2026-64855/Wed, 11 Nov 2026 18:00:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-soapbar-auth-bypass-cve-2026-64855/The soapbar Python SOAP library contains an authentication bypass vulnerability in the verify_envelope_bsp function, allowing attackers to forge SOAP envelopes by using self-signed certificates.The soapbar Python SOAP library contains an authentication bypass vulnerability in the verify_envelope_bsp() function (CVE-2026-64855). The function incorrectly derives trust anchors from the wsse:BinarySecurityToken within the message itself, rather than performing CA-chain validation or certificate pinning.

Impact

An attacker can supply a self-signed certificate within the SOAP message, which the library incorrectly accepts as authentic. This flaw permits attackers to forge signed SOAP envelopes, resulting in a complete bypass of authentication mechanisms relying on verify_envelope_bsp().

Recommendation

Upgrade the soapbar library to version 0.13.0 or later to ensure that trust anchors are properly validated.

]]>highadvisory