CVE-2023-34035
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet.
Risk Assessment
The organization may be exposed to unauthorized access to resources if authorization rules are misconfigured, potentially leading to serious security breaches.
Recommendation
It is recommended to update Spring Security to versions 5.8.5, 6.0.5, or 6.1.2 and review the configuration of authorization rules to ensure they are correctly set.
Other vulnerabilities in Spring Security
See all- CVE-2014-0097High
The ActiveDirectoryLdapAuthenticator in Spring Security versions 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds, it may incorrectly authenticate a user who supplies an empty password.
- CVE-2026-59270Critical
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Affected versions include Spring Security 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, 6.4.0-6.4.18, 5.8.0-5.8.27, and 5.7.0-5.7.25.
- CVE-2026-59277Low
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as internal (private) or external (public). Affects Spring Security 7.1.0.
- CVE-2026-59276Medium
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.
- CVE-2026-47877High
Spring Security Authorization Server versions 7.1.0 and 7.0.0-7.0.6 are vulnerable because the default consent page renders user-controlled values without HTML entity encoding.
- CVE-2026-47842Medium
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Affected versions include Spring Security 5.7.0 through 7.1.0.
- CVE-2026-47841High
An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Affected versions: Spring Security 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, 6.4.0-6.4.18.
- CVE-2026-41707High
Authentication Bypass by Capture-replay vulnerability in Spring Security allows Spring Security's DPoPProofJwtDecoderFactory to contain a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.
- CVE-2026-47838Medium
The SubjectDnX509PrincipalExtractor in Spring Security does not correctly handle certain malformed X.509 certificate CN values, potentially reading the wrong username. A crafted certificate could allow an attacker to impersonate another user. Affected versions: 5.7.0-5.7.24, 5.8.0-5.8.26, 6.3.0-6.3.17, 6.4.0-6.4.17, 6.5.0-6.5.10.
- CVE-2026-41706Medium
A vulnerability in Spring Security's CookieRequestCache and CookieServerRequestCache stores the full absolute pre-authentication URL in a browser cookie. After login, the user is redirected to this URL without validation, enabling an open redirect attack.
Original NVD description (English source)
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet. (DispatcherServlet is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.) Specifically, an application is vulnerable when all of the following are true: * Spring MVC is on the classpath * Spring Security is securing more than one servlet in a single application (one of them being Spring MVC’s DispatcherServlet) * The application uses requestMatchers(String) to refer to endpoints that are not Spring MVC endpoints An application is not vulnerable if any of the following is true: * The application does not have Spring MVC on the classpath * The application secures no servlets other than Spring MVC’s DispatcherServlet * The application uses requestMatchers(String) only for Spring MVC endpoints