Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Spring Security — Vulnerabilities & Security Advisories 48

All 48 CVE vulnerabilities found in Spring Security, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities for the open-source Spring Security library, focusing on authentication and access control weaknesses in Java applications. It collects reported issues, primarily related to authorization bypasses and session management flaws, covering disclosures from 2023 through 2024. Here you can track the vendor's advisory history, analyze the impact of specific weakness classes, and review the product's past vulnerability timeline to assess risk and plan remediation strategies.

Vendor: Pivotal

CVE ID Title CVSS Severity Published
CVE-2026-59277 Spring Security InetAddressMatchers Incomplete Internal Network Classification 3.7 Low 2026-08-27
CVE-2026-59276 Timing Attack via Non-Constant-Time Comparison of Sensitive Values 5.9 Medium 2026-08-27
CVE-2026-59270 Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces 9.4 Critical 2026-08-27
CVE-2026-47877 Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) 8.2 High 2026-08-27
CVE-2026-47842 Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation 6.5 Medium 2026-08-26
CVE-2026-47841 WebAuthn User Verification Bypass via Session Serialization 7.4 High 2026-08-26
CVE-2026-41707 Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay CWE-294 7.4 High 2026-08-25
CVE-2026-47838 Unauthorized User Impersonation when Using X.509 Client Certificates CWE-287 6.8 Medium 2026-06-09
CVE-2026-41706 Open Redirect When Using CookieRequestCache CWE-601 6.1 Medium 2026-06-09
CVE-2026-41694 SAML Payloads Decrypted Without Valid Signature CWE-347 3.7 Low 2026-06-09
CVE-2026-41008 Spring Security Authorization Server Open Redirect via request_uri CWE-601 6.1 Medium 2026-06-09
CVE-2026-41003 Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting CWE-79 7.6 High 2026-06-09
CVE-2026-40993 Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry CWE-502 7.3 High 2026-06-09
CVE-2026-40988 Unbounded DEFLATE Inflation in SAML 2.0 Service Provider CWE-400 7.5 High 2026-06-09
CVE-2026-22754 ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules 7.5 High 2026-04-22
CVE-2026-22753 Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers 7.5 High 2026-04-22
CVE-2026-22748 Potential Security Misconfiguration when Using withIssuerLocation 5.3 Medium 2026-04-22
CVE-2026-22747 Unauthorized User Impersonation when Using X.509 Client Certificates 6.8 Medium 2026-04-22
CVE-2026-22746 User Attribute Enumeration when Using DaoAuthenticationProvider 3.7 Low 2026-04-22
CVE-2026-22751 Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions 4.8 Medium 2026-04-21
CVE-2026-22733 Authentication Bypass under Actuator CloudFoundry endpoints CWE-288 8.2 High 2026-03-19
CVE-2026-22732 Under Some Conditions Spring Security HTTP Headers Are not Written 9.1 Critical 2026-03-19
CVE-2025-22234 Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation CWE-208 5.3 Medium 2026-01-22
CVE-2025-41248 CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types 7.5 High 2025-09-16
CVE-2025-41232 CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods 9.1 Critical 2025-05-21
CVE-2025-22223 VMware Spring Security 安全漏洞 CWE-290 5.3 Medium 2025-03-24
CVE-2025-22228 CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length 7.4 High 2025-03-20
CVE-2024-38827 Spring Security Authorization Bypass for Case Sensitive Comparisons CWE-639 4.8 Medium 2024-12-02
CVE-2024-38810 Missing Authorization When Using @AuthorizeReturnObject CWE-287 6.5 Medium 2024-08-20
CVE-2024-22257 VMware Spring Security 安全漏洞 8.2 High 2024-03-18

All 48 known CVE vulnerabilities affecting Spring Security with full Chinese analysis, references, and POCs where available.