Threat Advisory

Spring Security Vulnerability Allows XSS Exploits

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High
[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in Spring Security libraries, specifically affecting versions 7.0.6 and 6.5.11. The flaws span cross‑site scripting in authentication filters, server‑side request forgery through outbound WebService calls, XML External Entity processing weaknesses, and validation bypasses that disable required security protocols. Together they enable attackers to inject malicious scripts into user sessions, force the application to connect to internal or cloud metadata services, extract sensitive configuration files, and bypass authentication mechanisms. For enterprises relying on these frameworks, the risk includes unauthorized data access, credential compromise, and potential disruption of critical business services.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in Spring Security libraries, specifically affecting versions 7.0.6 and 6.5.11. The flaws span cross‑site scripting in authentication filters, server‑side request forgery through outbound WebService calls, XML External Entity processing weaknesses, and validation bypasses that disable required security protocols. Together they enable attackers to inject malicious scripts into user sessions, force the application to connect to internal or cloud metadata services, extract sensitive configuration files, and bypass authentication mechanisms. For enterprises relying on these frameworks, the risk includes unauthorized data access, credential compromise, and potential disruption of critical business services.[emaillocker id="1283"]

  • CVE-2026-41003 – A cross‑site scripting vulnerability in Spring Security’s authentication filters allows an attacker who can influence RelyingPartyRegistration values to execute arbitrary JavaScript in the context of an authenticated user’s browser.
  • CVE-2026-40999 – An SSRF issue in Spring Web Services enables a remote actor to craft request headers that cause the server to initiate outbound connections to arbitrary destinations, including internal hosts or cloud metadata endpoints.
  • CVE-2026-40998 – An XML External Entity flaw arises from default document factory settings, permitting an attacker to supply malicious XML that can read local files or cause denial‑of‑service conditions.
  • CVE-2026-40994 – A validation failure disables required security protocol enforcement, allowing crafted requests to bypass authentication checks and gain unauthorized access to protected resources.

These vulnerabilities collectively present a high‑risk scenario that could lead to data leakage, credential theft, and service interruption if exploited. Organizations should treat the findings as urgent and prioritize assessment of their Spring Security deployments to understand potential exposure.

RECOMMENDATION:

  • We recommend you to update Spring Security to version 7.0.6.

REFERENCES:

The following reports contain further technical details:
https://securityonline.info/spring-security-vulnerabilities/

[/emaillocker]
crossmenu