CVE-2026-59276 Security Details

CVE ID

CVE-2026-59276

CWE

CWE-208

CVE Description

Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

Published

Aug 21, 2026

CVSS Score & Severity

8.2High

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.332%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/security/core/token/KeyBasedPersistenceTokenService.computeKey(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;

JVMVulnerable params: 1

org/springframework/security/crypto/password4j/BalloonHashingPassword4jPasswordEncoder.matchesNonNull(Ljava/lang/String;Ljava/lang/String;)Z

JVMVulnerable params: 0

org/springframework/security/oauth2/server/authorization/InMemoryOAuth2AuthorizationService.matchesAccessToken(Lorg/springframework/security/oauth2/server/authorization/OAuth2Authorization;Ljava/lang/String;)Z

JVMVulnerable params: 1

org/springframework/security/oauth2/server/authorization/InMemoryOAuth2AuthorizationService.matchesAuthorizationCode(Lorg/springframework/security/oauth2/server/authorization/OAuth2Authorization;Ljava/lang/String;)Z

JVMVulnerable params: 1

org/springframework/security/oauth2/server/authorization/InMemoryOAuth2AuthorizationService.matchesDeviceCode(Lorg/springframework/security/oauth2/server/authorization/OAuth2Authorization;Ljava/lang/String;)Z

JVMVulnerable params: 1

org/springframework/security/oauth2/server/authorization/InMemoryOAuth2AuthorizationService.matchesIdToken(Lorg/springframework/security/oauth2/server/authorization/OAuth2Authorization;Ljava/lang/String;)Z

JVMVulnerable params: 1

org/springframework/security/oauth2/server/authorization/InMemoryOAuth2AuthorizationService.matchesRefreshToken(Lorg/springframework/security/oauth2/server/authorization/OAuth2Authorization;Ljava/lang/String;)Z

JVMVulnerable params: 1

org/springframework/security/oauth2/server/authorization/InMemoryOAuth2AuthorizationService.matchesState(Lorg/springframework/security/oauth2/server/authorization/OAuth2Authorization;Ljava/lang/String;)Z

JVMVulnerable params: 1

org/springframework/security/oauth2/server/authorization/InMemoryOAuth2AuthorizationService.matchesUserCode(Lorg/springframework/security/oauth2/server/authorization/OAuth2Authorization;Ljava/lang/String;)Z

JVMVulnerable params: 1

org/springframework/security/token/KeyBasedPersistenceTokenService.verifyToken(Ljava/lang/String;)Lorg/springframework/security/token/Token;

JVMVulnerable params: 0

org/springframework/security/web/authentication/www/DigestAuthenticationFilter.doFilter(Ljakarta/servlet/http/HttpServletRequest;Ljakarta/servlet/http/HttpServletResponse;Ljakarta/servlet/FilterChain;)V

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT