CVE-2026-50338

CVE-2026-50338 Spring Cloud Azure B2C Resource Server Cross-Issuer Authentication Bypass Description AadB2cResourceServerAutoConfiguration in spring-cloud-azure-autoconfigure builds a JwtDecoder that trusts six AAD-line issuers login.microsoftonline.com, sts.windows.net, sts.chinacloudapi.cn, v1...

Improper Authentication

Spring Cloud Azure is vulnerable to improper authentication. The vulnerability is due to insufficient authentication controls, which allows an unauthorized attacker to elevate privileges over a network...

Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical." Microsoft notes that 2 of the vulnerabilities disclosed this month have been exploited in the wild:...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication through the AadOidcIdTokenDecoderFactory and AadB2cOidcIdTokenDecoderFactory OIDC ID token decoders in the Spring Cloud Azure OAuth2 login components. An attacker can elevate privileges and sign in as an...

CVE-2026-69854

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-73791

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69854

CVE-2026-69854 is an improper authentication vulnerability in Spring Cloud Azure that allows an unauthorized attacker to elevate privileges over a network . The CNA (Microsoft) assigned a CVSS 3.1 score of 9.0 (CRITICAL) with a changed scope , reflecting high impact on confidentiality, integrity,...

Spring Cloud Azure Elevation of Privilege Vulnerability

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69854: Improper Authentication

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

PT-2026-87760

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

Exploit for CVE-2026-50338

CVE-2026-50338 Spring Cloud Azure B2C Resource Server Cross-I...

This Week in Spring - January 31st, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm not going to spend too much time here in the preamble because a today's both my birthday and my late father's birthday and b I got the worst gift ever: COVID-19. Sigh. So, I'm going back to bed. Without further ado, let's...

Spring Cloud Azure 5.0 is now Generally Available

Were very pleased to announce that Spring Cloud Azure 5.0 is now generally available. This major release includes the following features, improvements, and documentation updates: Compatible with Spring Boot 3 and Spring Cloud 2022.0.0 Supports Passwordless Connections Updated Azure for Spring...

Spring Cloud Azure 5.0 is now Generally Available

We're very pleased to announce that Spring Cloud Azure 5.0 is now generally available. This major release includes the following features, improvements, and documentation updates: Compatible with Spring Boot 3 and Spring Cloud 2022.0.0 Supports Passwordless Connections Updated Azure for Spring...

Spring Cloud Azure 5.0 is now Generally Available

We're very pleased to announce that Spring Cloud Azure 5.0 is now generally available. This major release includes the following features, improvements, and documentation updates: Compatible with Spring Boot 3 and Spring Cloud 2022.0.0 Supports Passwordless Connections Updated Azure for Spring...

Spring Cloud Azure 4.0 is Now Generally Available

NOTE: Hi, Spring fans! This is a guest post from Sean Li, our friend at Microsoft I am pleased to announce that Spring Cloud Azure 4.0 is now generally available. With this major release we aim to bring better security, leaner dependencies, support for production readiness and more. Version 4...