EUVD-2026-66187

Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs...

CVE-2026-47842: Undefined Security Weakness

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Sprin...

PT-2026-82246

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Spring Security versions 7.0.0 through 7.0.6 Spring Security versions 6.5.0 through 6.5.11 Spring Security versions 6.4.0 through 6.4.18 Spring Security versions 5.8.0 through 5.8.27 Spring Security versions 5.7.0...

CVE-2026-47841: Undefined Security Weakness

An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18...

PT-2026-82233

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Spring Security versions 7.0.0 through 7.0.6 Spring Security versions 6.5.0 through 6.5.11 Spring Security versions 6.4.0 through 6.4.18 Description An application using WebAuthn support may be vulnerable to user...

CVE-2026-41707

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

CVE-2026-41707 Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

CVE-2026-41707 Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

CVE-2026-41707 Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

CVE-2026-41707

Spring Security 's DPoPProofJwtDecoderFactory is vulnerable to a cache-based replay attack . The internal cache that stores JWT ID claims has a strict size limit, which an attacker can exploit by flooding the server with dummy requests to evict legitimate entries, then replaying intercepted valid...

CLSA-2026-1787661459 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.7.12-tuxcare.8...

CLSA-2026-1787649513 TuxCare security update for org.springframework.security (2 CVEs)

TuxCare rebuilt 18 org.springframework.security packages to address 2 CVEs. Fixed in 6.0.8-tuxcare.2...

CVE-2026-41707: Authentication Bypass by Capture-replay

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

PT-2026-81899

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Spring Security versions 7.0.0 through 7.0.6 Spring Security versions 6.5.0 through 6.5.11 Description An authentication bypass issue exists in the DPoPProofJwtDecoderFactory due to a cache-based replay attack. Th...

CLSA-2026-1787323603 TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 19 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.2-tuxcare.4...

cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay...

cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation

cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation...

Generation of Predictable IV with CBC Mode

Overview org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security. Affected versions of this package are vulnerable to Generation of Predictable IV with CBC Mode via AesBytesEncryptor when using the two-argument constructor or specifying a null I...

Comparison of Object References Instead of Object Contents

Overview Affected versions of this package are vulnerable to Comparison of Object References Instead of Object Contents in the process of comparing UserVerificationRequirement during WebAuthn authentication, when using distributed HTTP session stores. An attacker can bypass user verification by...

Binding to an Unrestricted IP Address

Overview org.springframework.security:spring-security-ldap is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Binding to an...