CVE-2026-59270: Spring Security LDAP Flaw Lets Attackers Read or Modify Directory Entries
Do Son 
TL;DR
VMware disclosed four Spring Security vulnerabilities. The most severe, CVE-2026-59270, rates CVSS 9.4 (CRITICAL). Its embedded LDAP server exposes an admin bind DN on all interfaces, letting an attacker read or modify entries in the in-memory directory. No exploitation in the wild or public proof-of-concept has been confirmed.
Why These Spring Security Vulnerabilities Matter
Spring Security guards authentication for countless Java applications. As a result, a single flaw can weaken many deployments at once. These four bugs hit core defenses. They touch LDAP, passkeys, token replay, and the OAuth consent screen. The official advisories live on the Spring Security page.
How the Attacks Work
CVE-2026-59270: Embedded LDAP Exposure
The embedded UnboundID server registers an admin credential automatically. It also binds to every network interface. Therefore anyone who reaches the port can log in with the well-known admin DN. From there, the attacker can read or modify entries in the in-memory directory.
CVE-2026-41707: DPoP Proof Replay
Spring Security caches used jti claims to block replay. However, the cache has a fixed size. An attacker who intercepts a valid proof can flood the server to evict the stored jti. Once evicted, the old proof works again, enabling impersonation.
CVE-2026-47841: WebAuthn Verification Bypass
Distributed session stores serialize the verification requirement. After deserialization, an identity check fails silently. Consequently, required user verification can be skipped during a passkey ceremony.
CVE-2026-47877: Consent Page XSS
The default OAuth2 consent page renders user values without encoding. So a crafted authorization request can inject stored script into the page.
Affected Versions
The bugs span Spring Security 5.7.x through 7.1.0, depending on the CVE. The LDAP flaw reaches furthest, back to 5.7.0. The consent page XSS affects only 7.0.x and 7.1.0.
Patch and Mitigation Steps
Upgrade now. Spring Security 7.1.1, 7.0.7, and matching 6.x and 5.x releases carry the fixes. Restrict LDAP listener access with a firewall as an added layer. Applications using a custom consent page avoid the XSS issue.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
