CVE-2026-41720

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://spring.io/security/cve-2026-41720

Configurations

No configuration.

History

23 Jul 2026, 08:10

Type	Values Removed	Values Added
Summary		(es) Las implementaciones de DirContextAuthenticationStrategy de Spring LDAP no rechazan una solicitud de enlace donde un nombre de usuario no vacío se empareja con una contraseña vacía o nula. Versiones afectadas: Spring LDAP 2.4.0 hasta 2.4.4; 3.2.0 hasta 3.2.17; 3.3.0 hasta 3.3.7; 4.0.0 hasta 4.0.3.

09 Jun 2026, 05:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 05:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-41720

Mitre link : CVE-2026-41720

CVE.ORG link : CVE-2026-41720

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-41720", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41720", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-09T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Spring", "product": "Spring LDAP", "versions": [{"status": "affected", "version": "2.4.0", "lessThan": "2.4.5", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.18", "versionType": "custom"}, {"status": "affected", "version": "3.3.0", "lessThan": "3.3.7.1", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.3.1", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-09T05:16:35.377", "references": [{"url": "https://spring.io/security/cve-2026-41720", "source": "security@vmware.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password.\n\nAffected versions:\nSpring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3."}, {"lang": "es", "value": "Las implementaciones de DirContextAuthenticationStrategy de Spring LDAP no rechazan una solicitud de enlace donde un nombre de usuario no vac\u00edo se empareja con una contrase\u00f1a vac\u00eda o nula.\n\nVersiones afectadas:\nSpring LDAP 2.4.0 hasta 2.4.4; 3.2.0 hasta 3.2.17; 3.3.0 hasta 3.3.7; 4.0.0 hasta 4.0.3."}], "lastModified": "2026-07-23T08:10:00.137", "sourceIdentifier": "security@vmware.com"}