This vulnerability (CVE-2026-40997) involves the generation of error messages containing sensitive information in Spring Web Services when integrated with Spring Security. Specifically, exception messages or callback outcomes may reveal detailed account states such as whether a user account is locked or disabled, instead of returning generic authentication errors. This behavior can be exploited by remote attackers to differentiate valid user accounts from invalid ones and to infer the lifecycle state of accounts. The affected versions are Spring Web Services 3.1.0 through 3.1.8, 4.0.0 through 4.0.18, 4.1.0 through 4.1.3, and 5.0.0 through 5.0.1. There is no vendor advisory or patch information available at this time, and the remediation level is unknown.

The vulnerability allows remote attackers to gain information about user account states (e.g., locked or disabled) through error messages, which can aid in user enumeration and account reconnaissance. This information disclosure does not directly impact system integrity or availability but compromises confidentiality by leaking sensitive authentication-related details.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing custom error handling to avoid exposing detailed account state information in error messages. Avoid revealing specific authentication failure reasons in responses to remote clients.