CVE-2026-41707— Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay
Quick assessment
Affected
Spring Spring Security
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Spring Security 的 存在基于缓存的重放攻击漏洞。该组件内部用于存储 JWT ID（ ）声明的缓存具有严格的容量限制，攻击者可通过向服务器发送大量伪造请求，将合法的缓存条目驱逐出去，随后重放截获的有效 DPoP 证明（DPoP Proof），从而实现攻击。 受影响版本： Spring Security 7.1.0 Spring Security 7.0.0 至 7.0.6 Spring Security 6.5.0 至 6.5.11
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-41707
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay
Source: CVE Program / CVE List V5
Vulnerability Description
Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.
This issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用捕获-重放进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Spring | Spring Security | 7.1.0 | - |
|
II. Public POCs for CVE-2026-41707
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41707
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-41707 (1)
IV. Related Vulnerabilities
Same product: Spring Security
-
CVE-2026-47838
Unauthorized User Impersonation when Using X.509 Client Cert -
CVE-2026-41706
Open Redirect When Using CookieRequestCache -
CVE-2026-41694
SAML Payloads Decrypted Without Valid Signature -
CVE-2026-41008
Spring Security Authorization Server Open Redirect via reque -
CVE-2026-41003
Unencoded HTML Outputs in Spring Security May Allow Cross-Si
Same vendor: Spring
-
CVE-2026-59318
DefaultToolCallingManager Global Resolver Fallback Allows Un -
CVE-2026-59308
Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Tru -
CVE-2026-59279
Unbounded persistent session allocation via repeated initial -
CVE-2026-59326
HTTP Proxy Credentials Logged in Plaintext by the Spring Boo -
CVE-2026-59328
Cross-Site Scripting in Eclipse Spring Boot Starter Wizard D
Same weakness: CWE-294
-
CVE-2026-65905
Apache Tomcat: Limited replay attack possible with DIGEST au -
CVE-2026-53424
Missing one-time-use enforcement in Samly allows replay of S -
CVE-2026-67581
On-chain transfer proof is not single-use in mpp EVM payment -
CVE-2026-73136
Static memo configuration in mpp Tempo disables per-challeng -
CVE-2026-76214
phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge
V. Comments for CVE-2026-41707
No comments yet