CVE-2026-41000

Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://spring.io/security/cve-2026-41000

Configurations

No configuration.

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Wss4jSecurityInterceptor no cableaba consistentemente instancias de Apache WSS4J ReplayCache en RequestData para comprobaciones en tiempo de validación. Como resultado, las protecciones contra la repetición de nonces de UsernameToken y marcas de tiempo de creación, elementos Timestamp, y ciertas semánticas de un solo uso de SAML podrían ser ineficaces incluso cuando los operadores configuraban una caché de repetición en el interceptor. Versiones afectadas: Spring Web Services 5.0.0 hasta 5.0.1; 4.1.0 hasta 4.1.3; 4.0.0 hasta 4.0.18; 3.1.0 hasta 3.1.8.

11 Jun 2026, 07:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-11 07:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-41000

Mitre link : CVE-2026-41000

CVE.ORG link : CVE-2026-41000

JSON object : View

Products Affected

No product.

CWE

CWE-294

Authentication Bypass by Capture-replay

{"id": "CVE-2026-41000", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41000", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-11T15:13:14.068411Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Spring", "product": "Spring Web Services", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.1.1", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.3.1", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.19", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.9", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-11T07:16:28.037", "references": [{"url": "https://spring.io/security/cve-2026-41000", "source": "security@vmware.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-294"}]}], "descriptions": [{"lang": "en", "value": "Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8."}, {"lang": "es", "value": "Wss4jSecurityInterceptor no cableaba consistentemente instancias de Apache WSS4J ReplayCache en RequestData para comprobaciones en tiempo de validaci\u00f3n. Como resultado, las protecciones contra la repetici\u00f3n de nonces de UsernameToken y marcas de tiempo de creaci\u00f3n, elementos Timestamp, y ciertas sem\u00e1nticas de un solo uso de SAML podr\u00edan ser ineficaces incluso cuando los operadores configuraban una cach\u00e9 de repetici\u00f3n en el interceptor.\n\nVersiones afectadas:\nSpring Web Services 5.0.0 hasta 5.0.1; 4.1.0 hasta 4.1.3; 4.0.0 hasta 4.0.18; 3.1.0 hasta 3.1.8."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "security@vmware.com"}