Threats affecting pkg:maven/org.springframework.ldap/spring-ldap

CVE-2026-41720 is a high-severity vulnerability in Spring LDAP where certain DirContextAuthenticationStrategy implementations improperly accept bind requests with a non-empty username and an empty or null password. This affects multiple versions of Spring LDAP, specifically 2.4.0 through 2.4.4, 3.2.0 through 3.2.17, 3.3.0 through 3.3.7, and 4.0.0 through 4.0.3. The vulnerability relates to improper authentication (CWE-287) and could allow unauthorized access if exploited.