The vulnerability arises because Wss4jSecurityInterceptor in Spring Web Services versions 3.1.0 through 3.1.8, 4.0.0 through 4.0.18, 4.1.0 through 4.1.3, and 5.0.0 through 5.0.1 did not consistently wire Apache WSS4J ReplayCache instances into RequestData during validation. This inconsistent wiring results in ineffective protections against replay attacks involving UsernameToken nonces, creation timestamps, Timestamp elements, and certain SAML one-time-use semantics, even when a replay cache was configured. The CVSS v3.1 base score is 3.7 (low), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact. No official patch or remediation level is provided in the available data.

The vulnerability could allow an attacker to bypass authentication protections by replaying previously captured tokens or timestamps, potentially leading to limited integrity impact. However, there is no impact on confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is indicated, operators should monitor vendor communications for updates. Until a fix is available, carefully review configurations of Wss4jSecurityInterceptor and consider additional compensating controls to detect or prevent replay attacks.