THE page discusses the disclosure of critical vulnerabilities in Spring Security software by VMware. The most severe vulnerability, CVE-2026-59270, has a CVSS score of 9.4, allowing unauthorized access to an embedded LDAP server, which can lead to reading or modifying sensitive directory entries. Other vulnerabilities include issues with DPoP proof replay, WebAuthn verification bypass, and an XSS risk in the OAuth consent page. Affected versions range from Spring Security 5.7.x to 7.1.0.
It is recommended to upgrade to Spring Security versions 7.1.1, 7.0.7, or applicable 6.x and 5.x releases as a mitigation step and restrict LDAP access.