CVE-2026-41707
published 2026-08-25CVE-2026-41707: Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based…
PriorityP353high7.4CVSS 3.1
AVNACHPRNUINSUCHIHAN
EPSS
0.39%
32.0th percentile
Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.
This issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| spring | spring_security | — | — |
| spring | spring_security | 6.5.0 – 6.5.11 | — |
| spring | spring_security | 7.0.0 – 7.0.6 | — |
| vmware | spring_security | >= 6.5.0 < 6.5.12 | 6.5.12 |
| vmware | spring_security | >= 7.0.0 < 7.0.6.1 | 7.0.6.1 |
| vmware | spring_security | >= 7.1.0 < 7.1.0.1 | 7.1.0.1 |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
VMware Spring Security up to 6.5.11/7.0.6/7.1.0 DPoPProofJwtDecoderFactory authentication replay
vuldb·2026-09-25·CVSS 7.4
CVE-2026-41707 [HIGH] VMware Spring Security up to 6.5.11/7.0.6/7.1.0 DPoPProofJwtDecoderFactory authentication replay
A vulnerability was found in VMware Spring Security up to 6.5.11/7.0.6/7.1.0. It has been rated as critical. This vulnerability affects unknown code of the component DPoPProofJwtDecoderFactory. Performing a manipulation results in authentication bypass by capture-replay.
This vulnerability is cataloged as CVE-2026-41707. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability.
ghsa_unreviewed·2026-08-26
CVE-2026-41707 [HIGH] Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability.
Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Red Hat
org.springframework.security/spring-security-oauth2-client: Spring Security: DPoP Proof Replay via Cache Eviction
vendor_redhat·2026-08-25·CVSS 7.4
CVE-2026-41707 [HIGH] CWE-294 org.springframework.security/spring-security-oauth2-client: Spring Security: DPoP Proof Replay via Cache Eviction
org.springframework.security/spring-security-oauth2-client: Spring Security: DPoP Proof Replay via Cache Eviction
Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.
This issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.
A flaw was found in Spring Security's DPoPProofJwtDecoderFactory. This vulnerability allows a remote attacker to perform a replay attack by flooding the server with dummy requests, which evicts legiti
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-25
Published