securityonline.info 8/21/2026, 3:51:04 AM · external

Spring Security Bug CVE-2026-59270 Leaves LDAP Open to Attack

Spring Security Bug CVE-2026-59270 Leaves LDAP Open to Attack
CyberSIXT Evidence Panel
CISA KEV Not in KEV
Patch Patch Status Unknown

THE page discusses the disclosure of critical vulnerabilities in Spring Security software by VMware. The most severe vulnerability, CVE-2026-59270, has a CVSS score of 9.4, allowing unauthorized access to an embedded LDAP server, which can lead to reading or modifying sensitive directory entries. Other vulnerabilities include issues with DPoP proof replay, WebAuthn verification bypass, and an XSS risk in the OAuth consent page. Affected versions range from Spring Security 5.7.x to 7.1.0.

It is recommended to upgrade to Spring Security versions 7.1.1, 7.0.7, or applicable 6.x and 5.x releases as a mitigation step and restrict LDAP access.

View full article

Article by CyberSIXT