---
id: CVE-2026-41707
title: >-
  Authentication Bypass by Capture-replay vulnerability in Spring Spring
  Security allows Spring Security's DPoPProofJwtDecoderFactory contains a
  cache-based replay attack vulnerability
summary: >-
  Authentication Bypass by Capture-replay vulnerability in Spring Spring
  Security allows Spring Security's DPoPProofJwtDecoderFactory contains a
  cache-based replay attack vulnerability. The internal cache storing JWT ID
  claims has a strict…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-294
vendor: vmware
product: spring_security
affected:
  - 'spring_security >= 6.5.0, < 6.5.12'
  - 'spring_security >= 7.0.0, < 7.0.6.1'
  - 'spring_security >= 7.1.0, < 7.1.0.1'
patched:
  - spring_security 7.1.0.1
published: '2026-08-25'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:27:30.947'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41707'
references:
  - url: 'https://spring.io/security/cve-2026-41707'
    label: security@vmware.com
tags:
  - nvd
epss: 0.00254
epssPercentile: 0.17216
ingestedAt: '2026-09-24T14:44:21.303Z'
---

## Overview

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.

This issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.

## Affected

- `spring_security >= 6.5.0, < 6.5.12`
- `spring_security >= 7.0.0, < 7.0.6.1`
- `spring_security >= 7.1.0, < 7.1.0.1`

## Remediation

Upgrade past the affected range:

- `spring_security 7.1.0.1`