Spring Security (Spring) - vulnerabilities (CVEs)

28 CVEs, 0 in the last 30 days, 5 known versions, newest CVE from 2026-08-27. Vendor: Spring.

CVEs of Spring Security

• CVE-2026-59277 - CVSS 5.3 (medium), 2026-08-27: Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a…
• CVE-2026-59276 - CVSS 5.9 (medium), 2026-08-27: Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time…
• CVE-2026-59270 - CVSS 9.4 (critical), 2026-08-27: Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all…
• CVE-2026-47877 - CVSS 8.2 (high), 2026-08-27: Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security…
• CVE-2026-47842 - CVSS 6.5 (medium), 2026-08-26: Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with…
• CVE-2026-47841 - CVSS 7.4 (high), 2026-08-26: An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring…
• CVE-2026-41707 - CVSS 7.4 (high), 2026-08-25: Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based…
• CVE-2026-47838 - CVSS 8.1 (high), 2026-06-10: SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the…
• CVE-2026-41706 - CVSS 6.1 (medium), 2026-06-10: Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected…
• CVE-2026-41003 - CVSS 7.6 (high), 2026-06-10: An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.…
• CVE-2026-40993 - CVSS 7.3 (high), 2026-06-10: An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store…
• CVE-2026-41694 - CVSS 5.3 (medium), 2026-06-10: Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature,…
• CVE-2026-41008 - CVSS 6.1 (medium), 2026-06-10: Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious…
• CVE-2026-40988 - CVSS 7.5 (high), 2026-06-10: An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by…
• CVE-2026-22754 - CVSS 7.5 (high), 2026-04-22: Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet…
• CVE-2026-22753 - CVSS 7.5 (high), 2026-04-22: Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet…
• CVE-2026-22748 - CVSS 6.5 (medium), 2026-04-22: Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure…
• CVE-2026-22747 - CVSS 8.1 (high), 2026-04-22: Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead…
• CVE-2026-22746 - CVSS 3.7 (low), 2026-04-22: Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes,…
• CVE-2026-22751 - CVSS 4.8 (medium), 2026-04-21: Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a…
• CVE-2026-22733 - CVSS 8.2 (high), 2026-03-20: Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication…
• CVE-2025-22234 - CVSS 5.3 (medium), 2026-01-22: The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer…
• CVE-2025-41232 - CVSS 9.1 (critical), 2025-05-21: Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may…
• CVE-2025-22223 - CVSS 5.3 (medium), 2025-03-24: Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. …
• CVE-2025-22228 - CVSS 7.4 (high), 2025-03-20: BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are…
• CVE-2024-38810 - CVSS 7.5 (high), 2024-08-20: Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.
• CVE-2024-22234 - CVSS 7.4 (high), 2024-02-20: In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly…
• CVE-2019-11272 - CVSS 7.3 (high), 2019-06-26: Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application…
• CVE-2019-3795 - CVSS 5.3 (medium), 2019-04-09: Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using…