Information Exposure Through Timing Discrepancy in Spring Security - CVE-2026-59276

Vulnerability details

The vulnerability allows a remote attacker to recover security-sensitive values.

The vulnerability exists due to non-constant-time comparison of sensitive values in multiple Spring Security components when validating authentication values, verifying tokens, checking password hashes, or locating OAuth2 authorizations. A remote attacker can submit a very large number of guesses and measure response latency to recover security-sensitive values.

Successful exploitation requires precise timing measurement, low network jitter, and a very large number of requests. Depending on the affected code path, recovered values may include an authentication digest, verification key, password hash, or OAuth2 token value.

Affected software

How to mitigate CVE-2026-59276

External References

• https://spring.io/security/cve-2026-59276

Related Security Bulletins

• Multiple vulnerabilities in Spring Security
• Multiple vulnerabilities in IBM Library Support for Spring