CVE-2026-41707

Spring Security 's DPoPProofJwtDecoderFactory is vulnerable to a cache-based replay attack . The internal cache that stores JWT ID claims has a strict size limit, which an attacker can exploit by flooding the server with dummy requests to evict legitimate entries, then replaying intercepted valid...