CVE-2011-4314: Kay Framework Project Kay Framework

Medium severity, CVSS 5.8. EPSS: 3.1% chance of exploitation in the next 30 days.

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.

Affected products

• Kay Framework Project Kay Framework: up to and including 1.0.1; version 0.0.0 only; version 0.1.0 only; version 0.2.0 only; version 0.3.0 only; version 0.8.0 only; …
• Openid OPENID4JAVA: up to and including 0.9.5.593; version 0.9.2 only; version 0.9.3 only; version 0.9.4.339 only
• Red Hat JBoss Enterprise Application Platform: version 5.1.0 only; version 5.1.1 only; version 5.1.2 only

Published 2012-01-27. Last modified 2026-06-16.