CVE-2026-41707 Security Details

CVE ID

CVE-2026-41707

CWE

CWE-294

CVE Description

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs. This issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.

Published

Aug 21, 2026

CVSS Score & Severity

7.6High

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.390%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/security/oauth2/jwt/DPoPProofJwtDecoderFactory.setJwtValidatorFactory(Ljava/util/function/Function;)V

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT