CVE-2026-41707

Awaiting Analysis Awaiting Analysis - Queue

Replay Attack in Spring Security DPoPProofJwtDecoderFactory

Publication date: 2026-08-25

Last updated on: 2026-08-27

Assigner: VMware

Description

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs. This issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-27

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-41707

EUVD

EUVD-2026-66187

Affected Vendors & Products

Vendor	Product	Version / Range
spring_security	spring_security	7.1.0
spring_security	spring_security	From 7.0.0 (inc) to 7.0.6 (inc)
spring_security	spring_security	From 6.5.0 (inc) to 6.5.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

Executive Summary

This vulnerability is a cache-based replay attack in Spring Security's DPoPProofJwtDecoderFactory. The system caches JWT ID claims but has a strict size limit. Attackers can exploit this by sending many dummy requests to fill the cache, removing legitimate entries. They then replay intercepted valid DPoP proofs to gain unauthorized access.

Detection Guidance

To detect this vulnerability, monitor for unusual JWT ID claim cache evictions or replayed DPoP proofs. Check Spring Security logs for repeated JWT validation failures or cache overflow events. Inspect network traffic for duplicate DPoP proof submissions from the same client.

Impact Analysis

If you use affected Spring Security versions, attackers could bypass authentication by replaying stolen DPoP proofs after evicting legitimate cache entries. This may lead to unauthorized access to sensitive data or system functions, depending on the application's use of DPoP.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Non-compliance risks include fines, legal action, and reputational damage.

Mitigation Strategies

Upgrade Spring Security to versions 7.1.1 or later, 7.0.7 or later, or 6.5.12 or later to address the cache-based replay attack vulnerability in DPoPProofJwtDecoderFactory.

Hi! I’m here to help you understand CVE-2026-41707. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70