Spring Security
- Software type
- Web framework
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/21/2026, Spring Security recorded 7 security vulnerabilities in the last 90 days, of which 4 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Spring Security and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-59277Spring Security InetAddressMatchers Incomplete Internal Network ClassificationCVE-2026-59276Timing Attack via Non-Constant-Time Comparison of Sensitive ValuesCVE-2026-59270Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfacesCVE-2026-47877Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)CVE-2026-47842Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-59277Spring Security InetAddressMatchers Incomplete Internal Network Classification | Exploitation statusNot exploited | FixNo |
| SeverityLow |
CVE-2026-59276Timing Attack via Non-Constant-Time Comparison of Sensitive Values | Exploitation statusNot exploited | FixYes | Published08/27/2026 | SeverityMedium |
|---|
CVE-2026-59270Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces | Exploitation statusNot exploited | FixYes | Published08/27/2026 | SeverityCritical |
|---|
CVE-2026-47877Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) | Exploitation statusNot exploited | FixYes | Published08/27/2026 | SeverityHigh |
|---|
CVE-2026-47842Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation | Exploitation statusNot exploited | FixYes | Published08/26/2026 | SeverityMedium |
|---|
CVE-2026-47841WebAuthn User Verification Bypass via Session Serialization | Exploitation statusNot exploited | FixYes | Published08/26/2026 | SeverityHigh |
|---|
CVE-2026-41707Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay | Exploitation statusNot exploited | FixYes | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-47838Unauthorized User Impersonation when Using X.509 Client Certificates | Exploitation statusNot exploited | FixYes | Published06/09/2026 | SeverityMedium |
|---|
CVE-2026-41706Open Redirect When Using CookieRequestCache | Exploitation statusNot exploited | FixYes | Published06/09/2026 | SeverityMedium |
|---|
CVE-2026-41694SAML Payloads Decrypted Without Valid Signature | Exploitation statusNot exploited | FixYes | Published06/09/2026 | SeverityLow |
|---|
30 Results | Page 1 of 3