SB20260828170 - Multiple vulnerabilities in Spring Security

Description

This security bulletin contains information about 4 vulnerabilities.

1) Improper access control (CVE-ID: CVE-2026-41707)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain unauthorized access and impersonate the victim.

The vulnerability exists due to improper access control in DPoPProofJwtDecoderFactory when processing DPoP proofs and caching jti claims. A remote attacker can flood the server with dummy requests to evict a legitimate jti from the cache and replay an intercepted valid DPoP proof to gain unauthorized access and impersonate the victim.

Exploitation requires intercepting a legitimate user's valid DPoP proof.

2) Improper Authentication (CVE-ID: CVE-2026-47841)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass user verification during WebAuthn authentication.

The vulnerability exists due to improper comparison of UserVerificationRequirement in Spring Security WebAuthn support when handling serialized and deserialized HTTP session data in a distributed session store. A remote attacker can use an obtained user's authenticator device to complete WebAuthn authentication without satisfying the user verification step to bypass user verification during WebAuthn authentication.

Only applications that use WebAuthn authentication, explicitly configure userVerification = REQUIRED, and use a distributed HTTP session store are vulnerable.

3) Not Using an Unpredictable IV with CBC Mode (CVE-ID: CVE-2026-47842)

CWE-ID: CWE-329 - Not Using an Unpredictable IV with CBC Mode

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to the use of a fixed initialization vector in AesBytesEncryptor when encrypting data with the two-argument constructor or with a null IV generator and CBC mode. A remote user can read encrypted records and compare deterministic ciphertext values to disclose sensitive information.

This issue enables correlation of identical plaintext values across encrypted records and can support dictionary attacks by comparing pre-encrypted candidate values.

4) Cross-site scripting (CVE-ID: CVE-2026-47877)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.

The vulnerability exists due to cross-site scripting in the DefaultConsentPage when processing an OAuth2 authorization request containing user-controlled values. A remote attacker can send a specially crafted authorization request to execute arbitrary script in the victim's browser.

Only applications using the default consent page are affected; applications configured with a custom consent page are not affected. User interaction is required to load the consent page.

Remediation

Install update from vendor's website.

References

• https://spring.io/security/cve-2026-41707
• https://spring.io/security/cve-2026-47841
• https://spring.io/security/cve-2026-47842
• https://spring.io/security/cve-2026-47877