CVE-2026-64855 · Package
NO FIX YET · SEE WHAT TO DO
soapbar's verify_envelope_bsp() took its trust anchor from the certificate inside the message itself, with no CA chain, issuer or pinning check. An attacker can sign a forged SOAP envelope with their own certificate and have it pass verification as authenticated.
first public Jul 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only applications that call verify_envelope_bsp() and treat a successful result as proof of the sender's identity. verify_envelope(), which pins a caller-supplied certificate, was not affected. Services that do not use the BSP verification path are not exposed through this flaw.
Not affected if no-bsp-verification, uses-verify-envelope-with-pinned-cert
Who cares python, soap, soapbar, wss-security
pip show soapbar; versions below 0.13.0 are affected.verify_envelope_bsp to find where BSP verification is used as an authentication decision.0.13.0.soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verify_envelope_bsp() derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityToken, validated only that certificate's not-before / not-after dates, and then verified the signature against that same certificate. There was no CA-chain validation, no issuer/subject allowlist, and no pinning. A successful verify_envelope_bsp() therefore proved only that the envelope was signed by whoever supplied the embedded certificate — never that it was signed by a trusted party. An attacker who mints their own certificate, signs a forged envelope, and embeds that certificate in the token passes verification. Any consumer that treats a successful BSP verification as authentication can be impersonated (signature forgery / authentication bypass). verify_envelope() (which pins a caller-supplied x509_cert) was not affected — the flaw was specific to the BSP variant whose trust anchor came from the message. This issue has been patched in version 0.13.0.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.