{"id":"CVE-2026-41707","aliases":["CLSA-2026-1792072377","EUVD-2026-66187","GHSA-3488-4mh8-47j4"],"status":"published","title":"Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay","description":"Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.\n\nThis issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0039,"percentile":0.33427,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-294"],"published":"2026-08-25T22:34:30Z","modified":"2026-11-02T19:46:28Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.11"},{"fixed":"6.5.11-tuxcare.3"}]}],"versions":["6.5.11","6.5.11-tuxcare.1","6.5.11-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.11"},{"fixed":"6.5.11-tuxcare.3"}]}],"versions":["6.5.11","6.5.11-tuxcare.1","6.5.11-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.11"},{"fixed":"6.5.11-tuxcare.3"}]}],"versions":["6.5.11","6.5.11-tuxcare.1","6.5.11-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.11"},{"fixed":"6.5.11-tuxcare.3"}]}],"versions":["6.5.11","6.5.11-tuxcare.1","6.5.11-tuxcare.2"],"bundled":4}],"products":[{"vendor":"spring","product":"spring security"},{"vendor":"vmware","product":"spring_security"}],"references":[{"url":"https://spring.io/security/cve-2026-41707","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41707","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3488-4mh8-47j4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41707.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-41707","title":"Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay","description":"Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.\n\nThis issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.","status":"published","published":"2026-08-25T22:34:30.57Z","modified":"2026-08-27T03:57:13.462Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-66187","description":"Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.\n\nThis issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.","status":"published","published":"2026-08-25T22:34:30Z","modified":"2026-08-27T03:57:13Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:28.934147Z"}],"ghsa":[{"id":"GHSA-3488-4mh8-47j4","title":"Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability....","description":"Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11","status":"published","published":"2026-08-26T00:31:03Z","modified":"2026-08-26T18:31:51Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T15:10:59.944342Z"}],"nvd":[{"id":"CVE-2026-41707","description":"Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.\n\nThis issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.","status":"published","published":"2026-08-25T23:16:59.933Z","modified":"2026-09-24T14:27:30.947Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:12:41.66469Z"}],"osv":[{"id":"CVE-2026-41707","title":"Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay","description":"Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.\n\nThis issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.","status":"published","published":"2026-08-25T22:34:30.57Z","modified":"2026-10-28T02:30:41.089053291Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"CLSA-2026-1792072377","title":"TuxCare security update for org.springframework.security (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 4 CVEs. Fixed in 6.5.11-tuxcare.3.","status":"published","published":"2026-10-15T13:52:57Z","modified":"2026-11-02T19:46:28.432973088Z","updated_at":"2026-11-02T20:29:06.487335Z"}]}}