soapbar: Authentication bypass in verify_envelope_bsp via self-supplied certificate
Summary
soapbar, a Python SOAP library, versions before 0.13.0 let verify_envelope_bsp() trust the X.509 certificate embedded in the message itself. The function checks only the certificate's validity dates and verifies the signature against that same certificate, with no CA chain validation, allowlist or pinning. An unauthenticated attacker can sign a forged SOAP envelope with their own certificate, embed it, and pass verification. This affects applications that treat a successful BSP verification as proof of identity; verify_envelope() with a caller-pinned certificate is not affected.
Affected
- soapbar versions before 0.13.0 (CVE record: affected < 0.13.0)
- Only code that calls verify_envelope_bsp() and relies on its result for authentication is exposed
Fixed in
- Fixed in soapbar 0.13.0 (released 2026-07-03)
- The vendor's latest release at the time of writing was 0.20.4
Workaround
- No workaround is documented by the vendor.
- Interim option for unpatched code: do not use verify_envelope_bsp() as an authentication decision and switch to verify_envelope() with a pinned certificate, after testing. Do not enable verify_cert_trust=False, as it restores the insecure behaviour.
Exploitation
- Not known to be exploited in the wild.
- No public proof of concept was found at the time of research.
- The vulnerability requires no privileges and no user interaction (CVSS 3.1 8.2, AV:N/AC:L/PR:N/UI:N).
Our recommendation
- Inventory all Python services and clients and their pinned soapbar versions, for example in requirements files or a software bill of materials.
- Upgrade to soapbar 0.13.0 or later; the current 0.20.x line is preferable, but test compatibility first.
- Review any code that uses verify_envelope_bsp() for authentication and pin the expected signer certificate or use a trusted CA.
- Prioritise internet-reachable SOAP endpoints that use WS-Security with BinarySecurityToken.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub pull request #71 (fix) github.com
- soapbar release v0.13.0 github.com
- GHSA-859w-52fx-hcm6 security advisory github.com
- OffSeq threat radar: CVE-2026-64855 radar.offseq.com
- soapbar 0.20.4 on PyPI pypi.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:21.
Original description (NVD)
soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verify_envelope_bsp() derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityToken, validated only that certificate's not-before / not-after dates, and then verified the signature against that same certificate. There was no CA-chain validation, no issuer/subject allowlist, and no pinning. A successful verify_envelope_bsp() therefore proved only that the envelope was signed by whoever supplied the embedded certificate — never that it was signed by a trusted party. An attacker who mints their own certificate, signs a forged envelope, and embeds that certificate in the token passes verification. Any consumer that treats a successful BSP verification as authentication can be impersonated (signature forgery / authentication bypass). verify_envelope() (which pins a caller-supplied x509_cert) was not affected — the flaw was specific to the BSP variant whose trust anchor came from the message. This issue has been patched in version 0.13.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.