CVE-2026-59270

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers a well-known administrative bind DN and binds its listener to all available network interfaces , exposing the credential to any network-reachable host. This affects Spring Security 5.7.0 through 7.1.0 ...

CVE-2026-47841

Spring Security 's WebAuthn support is vulnerable to a user verification bypass when the application uses a distributed HTTP session store . The root cause is tied to session serialization , which can allow an attacker to bypass the user verification step of a WebAuthn authenticator. Affected ver...

CVE-2026-47842

Spring Security 's AesBytesEncryptor deterministically encrypts data with AES/CBC when the two-argument constructor is used or a null IV generator is passed with CBC mode, resulting in a null (all-zero) initialization vector . This causes identical plaintexts to always produce identical ciphertex...

CVE-2026-59276

Spring Security is affected by a timing attack vulnerability in several components that compare security-sensitive values using standard String.equals() instead of a constant-time comparison. Because String.equals() returns as soon as a differing character is found, the response time for rejectin...

CVE-2026-59277

Spring Security 7.1.0 contains a misclassification flaw in the InetAddressMatchers utility. The matchInternal() and matchExternal() builders fail to recognize the IPv4 and IPv6 any-local addresses (0.0.0.0 and :: ) as internal, causing matchExternal() to classify them as external. This enables ac...

CVE-2026-47877

Spring Security Authorization Server is vulnerable to Cross-Site Scripting (XSS) in its default consent page, which renders user-controlled values without HTML entity encoding. The flaw allows an attacker to inject scripts via crafted input reflected on the consent page, requiring user interactio...