CVE-2026-64855

soapbar is a SOAP library for Python — client, server, and WSDL handling.

soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verify_envelope_bsp() derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityToken, validated only that certificate's not-before / not-after dates, and then verified the signature against that same certificate. There was no CA-chain validation, no issuer/subject allowlist, and no pinning. A…

11. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-64855