Spring Security vulnerabilities

CVE-2026-59270 [CRITICAL] CWE-863 CVE-2026-59270: Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an a Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7

CVE-2026-22733 [HIGH] CWE-288 CVE-2026-22733: Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3

CVE-2025-41232 [CRITICAL] CWE-693 CVE-2025-41232: Spring Security Aspects may not correctly locate method security annotations on private methods. Thi Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: * You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and * You have Spring Security method annotations on a privat

CVE-2026-41707 [HIGH] CWE-294 CVE-2026-41707: Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Securi Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay

CVE-2026-22747 [HIGH] CWE-297 CVE-2026-22747: Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle cer Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7

CVE-2026-47838 [HIGH] CWE-287 CVE-2026-47838: SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN val SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected versions: Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6

CVE-2024-22234 [HIGH] CWE-284 CVE-2024-22234: In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method. Specifically, an application is vulnerable if: * The application uses AuthenticationTrustResolver.isFullyAuthentic

CVE-2026-47841 [HIGH] CWE-863 CVE-2026-47841: An application using Spring Security's WebAuthn support may be vulnerable to user verification bypas An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18

CVE-2026-40993 [HIGH] CWE-502 CVE-2026-40993: An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataReposi An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively). Affected ve

CVE-2026-22754 [HIGH] CWE-284 CVE-2026-22754: Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/se Vulnerability in Spring Spring Security. If an application uses to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.

CVE-2026-22753 [HIGH] CWE-693 CVE-2026-22753: Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a P Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the application. This can lead to the authentication, authorization

CVE-2019-11272 [HIGH] CWE-287 CVE-2019-11272: Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text pass Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null

CVE-2024-38810 [HIGH] CWE-287 CVE-2024-38810: Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows at Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.

CVE-2025-22228 [HIGH] CWE-287 CVE-2025-22228: BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

CVE-2026-40988 [HIGH] CWE-400 CVE-2026-40988: An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Lo An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 throu

CVE-2026-22748 [MEDIUM] CWE-20 CVE-2026-22748: Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtD Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.

CVE-2026-47842 [MEDIUM] CWE-326 CVE-2026-47842: Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV gen Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.

CVE-2026-41706 [MEDIUM] CWE-601 CVE-2026-41706: Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication reque Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is used without validation as the post-login redirect targe

CVE-2026-59276 [MEDIUM] CWE-208 CVE-2026-59276: Several components in Spring Security compare security-sensitive values using standard string equali Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expe

CVE-2026-41008 [MEDIUM] CWE-601 CVE-2026-41008: Spring Security Authorization Server's authorization endpoint performs insufficient validation of th Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an invalid request_uri and an arbitrary, unvalidated redirect_uri, which can lead to an Open Redirect vulnerability. Affected versions: Spring Security 7.0.0