Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData, contradicting the intended secure default and published setter contract. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules around signatures and related constructs, weakening protocol-level checks that are meant to constrain interoperable, safe use of WS-Security.

Preconditions include use of Wss4jSecurityInterceptor (or equivalent wiring) for inbound validation without explicitly enabling BSP compliance.