SB20260828170 - Multiple vulnerabilities in Spring Security
Published: August 28, 2026 Updated: August 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-41707)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain unauthorized access and impersonate the victim.
The vulnerability exists due to improper access control in DPoPProofJwtDecoderFactory when processing DPoP proofs and caching jti claims. A remote attacker can flood the server with dummy requests to evict a legitimate jti from the cache and replay an intercepted valid DPoP proof to gain unauthorized access and impersonate the victim.
Exploitation requires intercepting a legitimate user's valid DPoP proof.
2) Improper Authentication (CVE-ID: CVE-2026-47841)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass user verification during WebAuthn authentication.
The vulnerability exists due to improper comparison of UserVerificationRequirement in Spring Security WebAuthn support when handling serialized and deserialized HTTP session data in a distributed session store. A remote attacker can use an obtained user's authenticator device to complete WebAuthn authentication without satisfying the user verification step to bypass user verification during WebAuthn authentication.
Only applications that use WebAuthn authentication, explicitly configure userVerification = REQUIRED, and use a distributed HTTP session store are vulnerable.
3) Not Using an Unpredictable IV with CBC Mode (CVE-ID: CVE-2026-47842)
CWE-ID: CWE-329 - Not Using an Unpredictable IV with CBC Mode
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to the use of a fixed initialization vector in AesBytesEncryptor when encrypting data with the two-argument constructor or with a null IV generator and CBC mode. A remote user can read encrypted records and compare deterministic ciphertext values to disclose sensitive information.
This issue enables correlation of identical plaintext values across encrypted records and can support dictionary attacks by comparing pre-encrypted candidate values.
4) Cross-site scripting (CVE-ID: CVE-2026-47877)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.
The vulnerability exists due to cross-site scripting in the DefaultConsentPage when processing an OAuth2 authorization request containing user-controlled values. A remote attacker can send a specially crafted authorization request to execute arbitrary script in the victim's browser.
Only applications using the default consent page are affected; applications configured with a custom consent page are not affected. User interaction is required to load the consent page.
5) Improper access control (CVE-ID: CVE-2026-59270)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read or modify entries in the in-memory directory.
The vulnerability exists due to improper access control in UnboundIdContainer when the embedded LDAP server binds its listener to all available network interfaces and registers a well-known administrative bind DN. A remote attacker can authenticate to the LDAP listener using the well-known administrative bind DN to read or modify entries in the in-memory directory.
The application must use UnboundIdContainer, either directly or through Spring Boot auto-configuration, and the LDAP listener port must be reachable from the attacker's network position.
6) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-59276)
CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to recover security-sensitive values.
The vulnerability exists due to non-constant-time comparison of sensitive values in multiple Spring Security components when validating authentication values, verifying tokens, checking password hashes, or locating OAuth2 authorizations. A remote attacker can submit a very large number of guesses and measure response latency to recover security-sensitive values.
Successful exploitation requires precise timing measurement, low network jitter, and a very large number of requests. Depending on the affected code path, recovered values may include an authentication digest, verification key, password hash, or OAuth2 token value.
7) Improper access control (CVE-ID: CVE-2026-59277)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass a network-based access control check.
The vulnerability exists due to improper access control in InetAddressMatchers when classifying IP addresses with matchInternal() or matchExternal(). A remote attacker can use an address of 0.0.0.0 or :: to bypass a network-based access control check.
The issue affects applications that rely on this classification to treat 0.0.0.0 or :: as internal addresses.
Remediation
Install update from vendor's website.