CVE-2026-82379: Java Wsse Username Token Replayable Authenticationcve-2026-82379-java-wsse-username-token-replayable-authentication
WSSE UsernameToken authentication recomputes the digest from the client-supplied Nonce and Created values plus the stored password and grants access by a plain String equality against the client-supplied PasswordDigest, without enforcing nonce uniqueness (replay cache) or Created-timestamp freshness. A captured X-WSSE header therefore stays valid forever and
