CVE-2026-41000 Overview
CVE-2026-41000 affects Spring Web Services, where the Wss4jSecurityInterceptor failed to consistently wire Apache WSS4J ReplayCache instances into RequestData during validation. As a result, replay protections for WS-Security tokens were silently ineffective even when operators configured a replay cache on the interceptor. The flaw maps to CWE-294: Authentication Bypass by Capture-replay. An attacker who captures a valid SOAP message can resubmit it to bypass single-use semantics for UsernameToken nonces, creation timestamps, Timestamp elements, and certain SAML assertions.
Critical Impact
Replay-based authentication bypass against WS-Security protected SOAP endpoints, undermining the integrity guarantees operators believed they had configured.
Affected Products
- Spring Web Services 5.0.0 through 5.0.1
- Spring Web Services 4.1.0 through 4.1.3, and 4.0.0 through 4.0.18
- Spring Web Services 3.1.0 through 3.1.8
Discovery Timeline
- 2026-06-11 - CVE-2026-41000 published to NVD
- 2026-06-11 - Last updated in NVD database
Technical Details for CVE-2026-41000
Vulnerability Analysis
Spring Web Services provides Wss4jSecurityInterceptor to integrate Apache WSS4J validation into the SOAP message pipeline. WSS4J relies on a ReplayCache registered inside the RequestData context to detect repeated nonces, timestamps, and SAML one-time-use assertions. The interceptor accepted replay cache configuration from operators but did not consistently propagate those instances into the RequestData used at validation time.
When the cache reference is missing, WSS4J skips replay checks rather than raising an error. Validation proceeds as though every inbound message is fresh, even when its nonce or timestamp has already been processed. The defect is a logic gap in interceptor wiring rather than a cryptographic weakness in WSS4J itself.
Root Cause
The root cause is incomplete dependency injection between Wss4jSecurityInterceptor configuration and the per-request RequestData object handed to WSS4J validators. Configured ReplayCache instances for nonce, timestamp, and SAML one-time-use tracking were not attached to every validation path. Operators received no runtime indication that replay enforcement was disabled.
Attack Vector
The attack requires network access to a SOAP endpoint protected by Wss4jSecurityInterceptor and the ability to capture a legitimate WS-Security request. The attacker resends the captured message, including its original UsernameToken nonce, wsu:Created timestamp, or SAML assertion, within whatever freshness window the server accepts. Because no replay cache lookup occurs, the server treats the replayed message as valid and processes the embedded operation. Attack complexity is high because the attacker must first obtain a valid signed or token-bearing message and replay it before the timestamp window expires. See the Spring Security CVE-2026-41000 Advisory for vendor details.
Detection Methods for CVE-2026-41000
Indicators of Compromise
- Duplicate UsernameToken nonce values observed across separate SOAP requests within a short time window.
- Repeated wsu:Created timestamps appearing in requests from the same or differing client IP addresses.
- SAML assertions with identical AssertionID or ID values processed more than once by the service.
- Successful authentication events for operations the legitimate client did not initiate.
Detection Strategies
- Enable WSS4J debug logging and verify that ReplayCache instances are present in RequestData during validation of each message.
- Add request-side instrumentation that hashes inbound UsernameToken nonces and timestamps, then alerts on duplicates.
- Correlate SOAP access logs with downstream business transactions to identify duplicate execution of idempotent-sensitive operations.
Monitoring Recommendations
- Centralize SOAP gateway and application logs for WS-Security validation events and flag anomalies in nonce frequency.
- Track Spring Web Services version inventory across application servers to identify hosts still running affected releases.
- Monitor for unexpected re-issuance of session tokens or downstream actions that imply a replayed authentication.
How to Mitigate CVE-2026-41000
Immediate Actions Required
- Upgrade Spring Web Services to a fixed release line published in the Spring Security CVE-2026-41000 Advisory.
- Inventory all services using Wss4jSecurityInterceptor and confirm a ReplayCache is both configured and wired post-upgrade.
- Rotate any long-lived credentials or SAML signing keys if log review suggests message replay occurred.
Patch Information
Pivotal/Spring has published fixed versions of Spring Web Services that correctly propagate configured ReplayCache instances into RequestData. Operators should consult the Spring Security CVE-2026-41000 Advisory for the specific patched releases corresponding to the 3.1.x, 4.0.x, 4.1.x, and 5.0.x branches.
Workarounds
- Tighten the accepted wsu:Created timestamp window at the interceptor to reduce the replay opportunity until patching is complete.
- Place a WS-Security-aware gateway in front of vulnerable services to perform nonce and timestamp deduplication independently.
- Require mutually authenticated TLS so captured ciphertext cannot be replayed from arbitrary network locations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
