SS
Product
Spring Security
25
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 2High 10Medium 12Low 1
Watch
Add Spring Security to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-59270 | 9.1 | Aug 27 | Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces Affected: 7.1.0; 7.0.0 through 7.0.6; 6.5.0 through 6.5.11; 6.4.0 through 6.4.18; 5.8.0 through 5.8.27; 5.7.0 through 5.7.25 |
| CVE-2025-41232 | 9.1 | May 21 | CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods Affected: 6.4.x before 6.4.6 |
| CVE-2026-47838 | 8.1 | Jun 9 | Unauthorized User Impersonation when Using X.509 Client Certificates Affected: 5.7.0 before 5.7.25; 5.8.0 before 5.8.27; 6.3.0 before 6.3.18; 6.4.0 before 6.4.18; 6.5.0 before 6.5.10.2 |
| CVE-2026-22747 | 8.1 | Apr 22 | Unauthorized User Impersonation when Using X.509 Client Certificates Affected: 7.0.0 through 7.0.4 |
| CVE-2026-22733 | 8.1 | Mar 19 | Authentication Bypass under Actuator CloudFoundry endpoints Affected: 4.0.0 through 4.0.3; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.17; 2.7.0 through 2.7.31 |
| CVE-2026-40988 | 7.5 | Jun 9 | Unbounded DEFLATE Inflation in SAML 2.0 Service Provider Affected: 5.7.0 before 5.7.24; 5.8.0 before 5.8.26; 6.3.0 before 6.3.17; 6.4.0 before 6.4.17; 6.5.0 before 6.5.10.2; 7.0.0 before 7.0.5.1 |
| CVE-2026-22754 | 7.5 | Apr 22 | ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules Affected: 7.0.0 through 7.0.4 |
| CVE-2026-22753 | 7.5 | Apr 22 | Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers Affected: 7.0.0 through 7.0.4 |
| CVE-2026-47841 | 7.4 | Aug 26 | WebAuthn User Verification Bypass via Session Serialization Affected: 7.1.0; 7.0.0 through 7.0.6; 6.5.0 through 6.5.11; 6.4.0 through 6.4.18 |
| CVE-2026-41707 | 7.4 | Aug 25 | Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay Affected: 7.1.0; 7.0.0 through 7.0.6; 6.5.0 through 6.5.11 |
| CVE-2025-22228 | 7.4 | Mar 20 | CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length Affected: 5.7.x before 5.7.16; 5.8.x before 5.8.18; 6.0.x before 6.0.16; 6.1.x before 6.1.14; 6.2.x before 6.2.10; 6.3.x before 6.3.8; +1 more |
| CVE-2026-40993 | 7.2 | Jun 9 | Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry Affected: 7.0.0 before 7.0.5.1 |
| CVE-2026-47842 | 6.5 | Aug 26 | Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation Affected: 7.1.0; 7.0.0 through 7.0.6; 6.5.0 through 6.5.11; 6.4.0 through 6.4.18; 5.8.0 through 5.8.27; 5.7.0 through 5.7.25 |
| CVE-2026-22748 | 6.5 | Apr 22 | Potential Security Misconfiguration when Using withIssuerLocation Affected: 6.3.0 through 6.3.14; 6.4.0 through 6.4.14; 6.5.0 through 6.5.9; 7.0.0 through 7.0.4 |
| CVE-2026-47877 | 6.1 | Aug 27 | Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) Affected: 7.1.0; 7.0.0 through 7.0.6 |
| CVE-2026-41706 | 6.1 | Jun 9 | Open Redirect When Using CookieRequestCache Affected: 5.7.0 before 5.7.24; 5.8.0 before 5.8.26; 6.3.0 before 6.3.17; 6.4.0 before 6.4.17; 6.5.0 before 6.5.10.2; 7.0.0 before 7.0.5.1 |
| CVE-2026-41008 | 6.1 | Jun 9 | Spring Security Authorization Server Open Redirect via request_uri Affected: 7.0.0 before 7.0.5.1 |
| CVE-2026-59276 | 5.9 | Aug 27 | Timing Attack via Non-Constant-Time Comparison of Sensitive Values Affected: 7.1.0; 7.0.0 through 7.0.6; 6.5.0 through 6.5.11; 6.4.0 through 6.4.18; 5.8.0 through 5.8.27; 5.7.0 through 5.7.25 |
| CVE-2026-41003 | 5.4 | Jun 9 | Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting Affected: 5.7.0 before 5.7.24; 5.8.0 before 5.8.26; 6.3.0 before 6.3.17; 6.4.0 before 6.4.17; 6.5.0 before 6.5.10.2; 7.0.0 before 7.0.5.1 |
| CVE-2026-59277 | 5.3 | Aug 27 | Spring Security InetAddressMatchers Incomplete Internal Network Classification Affected: 7.1.0 |
| CVE-2026-41694 | 5.3 | Jun 9 | SAML Payloads Decrypted Without Valid Signature Affected: 5.7.0 before 5.7.24; 5.8.0 before 5.8.26; 6.3.0 before 6.3.17; 6.4.0 before 6.4.17; 6.5.0 before 6.5.10.2; 7.0.0 before 7.0.5.1 |
| CVE-2025-22234 | 5.3 | Jan 22 | Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation Affected: 5.7.16; 5.8.18; 6.0.16; 6.1.14; 6.2.10; 6.3.8; +1 more |
| CVE-2025-22223 | 5.3 | Mar 24 | Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods Affected: 6.4.0-6.4.3 |
| CVE-2026-22751 | 4.8 | Apr 21 | Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions Affected: 6.4.0 through 6.4.15; 6.5.0 through 6.5.9; 7.0.0 through 7.0.4 |
| CVE-2026-22746 | 3.7 | Apr 22 | User Attribute Enumeration when Using DaoAuthenticationProvider Affected: 5.7.0 through 5.7.22; 5.8.0 through 5.8.24; 6.3.0 through 6.3.15; 6.5.0 through 6.5.9; 7.0.0 through 7.0.4 |
Showing 25