CVE-2026-41000

Katalog CVE

CVSS 3.7 · Low EPSS 0,26%

Kerentanan Authentication Bypass by Capture-replay pada broadcom spring web services. Skor CVSS 3.1 3.7 (Low) menurut vmware.com.

Deskripsi (NVD)

Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Rincian

Terbit di NVD

11 Juni 2026

Terakhir diubah

4 September 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber vmware.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-294: Authentication Bypass by Capture-replay

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://spring.io/security/cve-2026-41000 advisory vendor · mitigasi