CVE-2026-41707 Overview
CVE-2026-41707 is an authentication bypass by capture-replay vulnerability [CWE-294] in Spring Security's DPoPProofJwtDecoderFactory. The internal cache that stores JSON Web Token (JWT) ID claims enforces a strict size limit. Attackers can flood the server with dummy requests to evict legitimate JWT ID entries. Once evicted, an attacker can replay a previously intercepted valid Demonstrating Proof-of-Possession (DPoP) proof to bypass replay protection.
The issue affects Spring Security 7.1.0, versions 7.0.0 through 7.0.6, and versions 6.5.0 through 6.5.11.
Critical Impact
Attackers who capture a valid DPoP proof can replay it after triggering cache eviction, defeating the anti-replay control that binds OAuth 2.0 access tokens to a client key.
Affected Products
- Spring Security 7.1.0
- Spring Security 7.0.0 through 7.0.6
- Spring Security 6.5.0 through 6.5.11
Discovery Timeline
- 2026-08-25 - CVE-2026-41707 published to the National Vulnerability Database
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-41707
Vulnerability Analysis
DPoP (RFC 9449) binds an OAuth 2.0 access token to a client-held cryptographic key by requiring the client to send a signed proof JWT with each request. To prevent replay of intercepted proofs, servers cache the jti (JWT ID) claim of accepted proofs and reject any subsequent proof reusing the same identifier within a time window.
Spring Security implements this cache inside DPoPProofJwtDecoderFactory. The cache enforces a fixed maximum size. When the cache fills, older entries are evicted to make room for new ones. This eviction policy is the source of the vulnerability.
An attacker who intercepts a valid DPoP proof (for example, on a compromised network hop or via a malicious proxy) can generate a high volume of dummy DPoP proofs with unique jti values. Submitting these to the server evicts the legitimate jti from the cache. The attacker then replays the intercepted proof, which the server accepts as new because its jti is no longer tracked.
Root Cause
The root cause is a bounded, evictable cache used as an anti-replay store. The design assumes cached jti entries persist for the DPoP proof's validity window. In practice, an attacker controls when entries are evicted by controlling cache pressure. This violates the anti-replay invariant that CWE-294 covers.
Attack Vector
Exploitation requires the attacker to first capture a valid DPoP proof for a target session. This raises attack complexity, which is reflected in the CVSS vector. Once a proof is captured, the attacker floods the DPoP-protected endpoint with high-cardinality dummy proofs to force eviction, then replays the captured proof to authenticate as the victim client. Refer to the Spring Security Advisory CVE-2026-41707 for vendor technical details.
Detection Methods for CVE-2026-41707
Indicators of Compromise
- Sudden bursts of DPoP-protected requests carrying unique jti claims from a single client, source IP, or narrow IP range.
- Repeated acceptance of the same DPoP jti value within the proof's validity window, observed across authentication logs.
- Unusual request volume against OAuth 2.0 resource endpoints protected by DPoPProofJwtDecoderFactory.
Detection Strategies
- Instrument the DPoP validation path to log every accepted jti, request timestamp, source IP, and client identifier for offline correlation.
- Alert when the DPoP jti cache reaches or approaches its configured maximum size, which indicates eviction pressure.
- Correlate captured session tokens with subsequent DPoP proof reuse across different source IPs or user agents.
Monitoring Recommendations
- Track per-client jti submission rates and flag clients exceeding a baseline threshold within short time windows.
- Monitor authentication success rates against resource servers using DPoP for anomalous spikes tied to a single access token.
- Forward Spring Security authentication logs to a centralized SIEM and retain them for the full DPoP proof validity window plus operational buffer.
How to Mitigate CVE-2026-41707
Immediate Actions Required
- Upgrade Spring Security to a fixed release line as identified in the vendor advisory before any other mitigation.
- Inventory applications using DPoPProofJwtDecoderFactory and prioritize internet-facing OAuth 2.0 resource servers.
- Rotate any OAuth 2.0 access tokens and DPoP key pairs suspected of interception during the exposure window.
Patch Information
Spring has published fixes as documented in the Spring Security Advisory CVE-2026-41707. Upgrade from affected versions 7.1.0, 7.0.0–7.0.6, and 6.5.0–6.5.11 to the patched releases listed in the advisory. Verify the resolved Spring Security version at runtime after deployment.
Workarounds
- Enforce Transport Layer Security (TLS) on all DPoP-protected endpoints to reduce the opportunity for proof interception.
- Reduce DPoP proof validity windows to shrink the time an attacker has to replay a captured proof after cache eviction.
- Rate-limit DPoP proof submissions per client and per source IP to slow cache-flooding attempts.
- Deploy a web application firewall (WAF) rule to throttle high-cardinality jti submissions against DPoP endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
