Replay Attack Vulnerability in Spring Security by Pivotal Software
CVE-2026-41707

7.4HIGH

Key Information:

Vendor

Spring

Status
Spring Security
Vendor
CVE Published:
25 August 2026

What is CVE-2026-41707?

Spring Security's DPoPProofJwtDecoderFactory is vulnerable to a cache-based replay attack. The internal cache, which manages JWT ID claims, has a restrictive size limit. This limitation enables attackers to flood the server with dummy requests, causing legitimate entries to be evicted. Consequently, attackers can replay intercepted valid DPoP proofs, compromising the integrity of user sessions and potentially leading to unauthorized access.

Affected Version(s)

Spring Security 7.1.0

Spring Security 7.0.0 <= 7.0.6

Spring Security 6.5.0 <= 6.5.11

References

https://spring.io/security/cve-2026-41707

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.