CVE-2026-41707: CWE-294 Authentication Bypass by Capture-replay in Spring Spring Security

Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability due to a strict size limit on the internal cache storing JWT ID claims. An attacker can flood the cache with dummy requests, causing eviction of legitimate cache entries, and then replay intercepted valid DPoP proofs to bypass authentication controls. This affects versions 7.1.0, 7.0.0 through 7.0.6, and 6.5.0 through 6.5.11 of Spring Security. The vulnerability is categorized under CWE-294 (Authentication Bypass). The CVSS 3.1 base score is 7.4, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity.

Successful exploitation allows attackers to bypass authentication by replaying valid DPoP proofs after evicting legitimate cache entries. This can lead to unauthorized access with high confidentiality and integrity impact. There is no indication of impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider monitoring for unusual authentication patterns and limit the rate of requests to reduce cache flooding risk. Avoid relying solely on the affected cache mechanism for critical authentication decisions.