Spring Spring Security
29 CVEs affecting Spring Spring Security. Latest disclosed: 2026-08-27. Critical: 2, High: 12.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-59270 | Critical | 9.4 | 2026-08-27 | Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all avai… |
CVE-2025-41232 | Critical | 9.1 | 2025-05-21 | Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may… |
CVE-2026-47877 | High | 8.2 | 2026-08-27 | Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security… |
CVE-2026-22733 | High | 8.2 | 2026-03-20 | Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication… |
CVE-2026-41003 | High | 7.6 | 2026-06-10 | An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affecte… |
CVE-2026-40988 | High | 7.5 | 2026-06-10 | An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by w… |
CVE-2026-22754 | High | 7.5 | 2026-04-22 | Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet… |
CVE-2026-22753 | High | 7.5 | 2026-04-22 | Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet… |
CVE-2026-47841 | High | 7.4 | 2026-08-26 | An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Secur… |
CVE-2026-41707 | High | 7.4 | 2026-08-25 | Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based repl… |
CVE-2025-22228 | High | 7.4 | 2025-03-20 | BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are… |
CVE-2024-22234 | High | 7.4 | 2024-02-20 | In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly use… |
CVE-2026-40993 | High | 7.3 | 2026-06-10 | An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store… |
CVE-2019-11272 | High | 7.3 | 2019-06-26 | Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application usi… |
CVE-2026-47838 | Medium | 6.8 | 2026-06-10 | SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the user… |
CVE-2026-22747 | Medium | 6.8 | 2026-04-22 | Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead… |
CVE-2026-47842 | Medium | 6.5 | 2026-08-26 | Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES… |
CVE-2024-38810 | Medium | 6.5 | 2024-08-20 | Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective. |
CVE-2026-41706 | Medium | 6.1 | 2026-06-10 | Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected… |
CVE-2026-41008 | Medium | 6.1 | 2026-06-10 | Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious… |