Skip to content
OpenAdvisories
High WID-SEC-2026-2956 7 CVEs

VMware Tanzu Spring Security: Mehrere Schwachstellen

Published Aug 20, 2026 · Updated Aug 27, 2026 · Revision 4 · de-DE

Vendor: VMware Tanzu Product: Spring Security Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Security ausnutzen, um Dateien zu manipulieren, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.

Product

Spring Security ist ein Framework, das Authentifizierung, Autorisierung und Schutz vor gängigen Angriffen bietet.

Vulnerabilities 7

  • Critical 9.4
    CVE-2026-59270

    Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces

    Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 …

    Spring Spring Security
  • High 8.2
    CVE-2026-47877

    Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

    Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6

    Spring Spring Security
  • High 7.4
    CVE-2026-41707

    Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

    Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing …

    Spring Spring Security
  • High 7.4
    CVE-2026-47841

    WebAuthn User Verification Bypass via Session Serialization

    An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18

    Spring Spring Security
  • Medium 6.5
    CVE-2026-47842

    Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation

    Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.…

    Spring Spring Security
  • Medium 5.9
    CVE-2026-59276

    Timing Attack via Non-Constant-Time Comparison of Sensitive Values

    Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to rejec…

    Spring Spring Security
  • Low 3.7
    CVE-2026-59277

    Spring Security InetAddressMatchers Incomplete Internal Network Classification

    Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. Spring Security 7…

    Spring Spring Security

Revision history

  1. #4

    Referenz(en) aufgenommen: EUVD-2026-67169, EUVD-2026-67168

  2. #3

    Referenz(en) aufgenommen: EUVD-2026-66639, EUVD-2026-66677

  3. #2

    Referenz(en) aufgenommen: EUVD-2026-66187

  4. #1

    Initiale Fassung

References