Information Exposure Through an Error Message in Spring Web Services - CVE-2026-40997
Published: August 28, 2026
Vulnerability identifier: #VU146191
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40997
CWE-ID: CWE-209
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper handling of authentication error messages in Spring WS integration paths with Spring Security when processing SOAP authentication requests. A remote attacker can send crafted authentication attempts to disclose sensitive information.
This can expose whether an account is valid and reveal account state details such as locked or disabled status through exception messages or callback outcomes. It affects username-token, digest, or X.509 validation paths where account status exceptions reach the SOAP layer without uniform BadCredentialsException handling.
Affected software
Spring Web Services
How to mitigate CVE-2026-40997
Install security update from vendor's website.
Spring Web Services - addressed in versions 3.1.9, 4.0.19, 4.1.3.1, 4.1.4, 5.0.1.1, 5.0.2