CVE-2026-47841

Spring Security 's WebAuthn support is vulnerable to a user verification bypass when the application uses a distributed HTTP session store . The root cause is tied to session serialization , which can allow an attacker to bypass the user verification step of a WebAuthn authenticator. Affected ver...

CVE-2021-22119

CVE-2021-22119 affects Spring Security: DoS via initiation of OAuth 2.0 Authorization Requests in Web and WebFlux clients. Affected versions include 5.5.x before 5.5.1, 5.4.x before 5.4.7, 5.3.x before 5.3.10, and 5.2.x before 5.2.11. Impact is denial of service (resource exhaustion) with a singl...

CVE-2024-22234

CVE-2024-22234 (Spring Security) Affected: Spring Security 6.1.x prior to 6.1.7 and 6.2.x prior to 6.2.2.Vulnerability: Broken access control when an application directly calls AuthenticationTrustResolver.isFullyAuthenticated(Authentication) with a null parameter, which can erroneously return tru...

CVE-2016-5007

CVE-2016-5007 affects Spring Security (3.2.x, 4.0.x, 4.1.0) and Spring Framework (3.2.x, 4.0.x, 4.1.x, 4.2.x). The root cause is differences in URL pattern matching/space trimming that can cause some paths to be treated as protected when they should not be, due to varying pattern matching between...

CVE-2019-11272

CVE-2019-11272 affects Spring Security where PlaintextPasswordEncoder can allow login with a password of "null" if an encoded password is null. Affected: Spring Security 4.2.x up to 4.2.12 and older unsupported versions. Root cause: using PlaintextPasswordEncoder with null encoded passwords. Impa...

CVE-2026-40988

CVE-2026-40988 refers to an issue in the use of the REDIRECT binding for SAML 2.0 Login/Logout with the Spring Security SAML2 Service Provider, where an unbounded writer can inflate the compressed SAML payload in memory, causing a denial of service. The vulnerability affects Spring Security versi...

CVE-2016-9879

CVE-2016-9879 affects Spring Security 3.2.x/4.1.x/4.2.x prior to fixed versions. The root cause is how path parameters are handled in the Servlet API: getPathInfo() may include encoded "/" characters, allowing an attacker to bypass security constraints when a request contains a path parameter wit...

CVE-2026-41003

CVE-2026-41003 affects Spring Security; an attacker who can influence values in RelyingPartyRegistration may be able to execute arbitrary code on HTML forms generated by Spring Security filters. Affected versions include Spring Security 5.7.0–5.7.23, 5.8.0–5.8.25, 6.3.0–6.3.16, 6.4.0–6.4.16, 6.5....

CVE-2023-34035

CVE-2023-34035 is a Spring Security authorization misconfiguration affecting Spring MVC apps that use requestMatchers(String) to reference endpoints and secure more than one servlet (including DispatcherServlet). The underlying issue is a misconfiguration that can occur when non-Spring MVC endpoi...

CVE-2014-0097

The CVE affects Spring Security’s ActiveDirectoryLdapAuthenticator (versions 3.2.0–3.2.1 and 3.1.0–3.1.5). It does not enforce password length, which can allow authentication of a user with an empty password if the directory permits anonymous binds. This is the stated vulnerability and its impact...

CVE-2026-22754

CVE-2026-22754 affects Spring Security 7.0.0–7.0.4. When an application uses to define the servlet path for a path matcher, the servlet path is not included and related authorization rules may not be exercised, potentially allowing an authorization bypass. The description provides the vulnerabil...

CVE-2024-38810

CVE-2024-38810 affects VMware Tanzu Spring Security; vulnerability arises from missing authorization when using @AuthorizeReturnObject, enabling an attacker to obtain sensitive information. Connected sources confirm affected components include Spring Security 6.3.0 and 6.3.1, with multiple vendor...

CVE-2026-40993

The CVE-2026-40993 issue affects Spring Security 7.0.0–7.0.5. Affected component: JdbcAssertingPartyMetadataRepository (table saml2_asserting_party_metadata). Root cause: unfiltered Java native deserialization of the BLOBs in verification_credentials and encryption_credentials. Impact: an attacke...

CVE-2026-22753

Spring Security CVE-2026-22753 affects versions 7.0.0 to 7.0.4 where using securityMatchers(String) together with a PathPatternRequestMatcher.Builder bean to prepend a servlet path can cause requests to fail matching against the filter chain, potentially rendering authentication, authorization, a...