SOAP security faults leak Spring Security account state
CVE-2026-40997

5.3MEDIUM

Key Information:

Vendor

Spring

Status
Spring Web Services
Vendor
CVE Published:
11 June 2026

What is CVE-2026-40997?

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Affected Version(s)

Spring Web Services 5.0.0 < 5.0.2

Spring Web Services 4.1.0 < 4.1.4

Spring Web Services 4.0.0 < 4.0.19

References

https://spring.io/security/cve-2026-40997

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.