CVE-2026-79571: Spring Boot Project Auth Bypass Vulnerability

CVE-2026-79571 Overview

CVE-2026-79571 is an incorrect access control vulnerability in the SellerAuthorizeAspect component of springboot-project v1.0.0. The flaw allows unauthenticated network attackers to reach seller-side management interfaces without providing valid credentials. Attackers can enumerate all products and orders, toggle product listing status, finish or cancel orders, and modify product categories. The weakness is classified under [CWE-284] Improper Access Control and affects the seller-side authorization aspect that should enforce authentication on privileged endpoints.

Critical Impact

Unauthenticated attackers can fully control seller-side commerce operations, including product visibility, order lifecycle, and category management, without any prior access or user interaction.

Affected Products

• springboot-project v1.0.0 (seller-side module)
• SellerAuthorizeAspect authorization component
• All seller management REST endpoints protected by the affected aspect

Discovery Timeline

• 2026-09-08 - CVE-2026-79571 published to the National Vulnerability Database (NVD)
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79571

Vulnerability Analysis

The vulnerability resides in SellerAuthorizeAspect, a Spring AOP aspect intended to enforce seller authentication before privileged operations execute. The aspect fails to reject unauthenticated requests, so the intercepted controller methods run regardless of session state. As a result, any anonymous HTTP client can invoke seller-only APIs. Impacted actions include listing every product and order in the system, changing product sale status, completing or canceling orders, and modifying product categories. These operations affect confidentiality and integrity across the entire seller inventory and order pipeline.

Root Cause

The root cause is a broken authorization check in the aspect that wraps seller management endpoints. The aspect does not validate the authenticated principal or session token before proceeding with method execution. Because Spring AOP interceptors are the sole enforcement point for these controllers, a missing or short-circuited check exposes every advised method. This aligns with [CWE-284] Improper Access Control, where the application permits actors to perform operations outside their intended permissions.

Attack Vector

Exploitation requires only network access to the application and knowledge of the target endpoint paths. An attacker sends direct HTTP requests to seller controller routes without a valid session cookie or authentication header. The SellerAuthorizeAspect permits the call to reach the handler, which then executes the privileged database operation. Public proof-of-concept material demonstrating this bypass is available on the researcher's GitHub PoC: Authentication Bypass writeup. No exploitation code is reproduced here; refer to the linked advisory for endpoint-level detail.

Detection Methods for CVE-2026-79571

Indicators of Compromise

• Unauthenticated HTTP requests to seller-side URL paths returning HTTP 200 responses instead of 401 or 403.
• Product on-sale or off-sale state transitions in application logs without a corresponding authenticated seller session identifier.
• Order status changes to finished or canceled attributed to null, empty, or anonymous user principals.
• Category modification events lacking associated authentication audit records.

Detection Strategies

• Review reverse-proxy and application access logs for seller endpoint hits that carry no session cookie or bearer token.
• Correlate order and product state-change events with authentication events to identify actions without a preceding successful login.
• Deploy web application firewall rules that require valid session tokens on all seller controller paths and alert on violations.

Monitoring Recommendations

• Enable verbose logging inside SellerAuthorizeAspect to record the resolved principal for every intercepted invocation.
• Alert on high-volume enumeration patterns against product and order listing endpoints from a single source address.
• Monitor database audit trails for bulk UPDATE statements against product, order, and category tables outside normal seller working hours.

How to Mitigate CVE-2026-79571

Immediate Actions Required

• Restrict network access to the seller-side application to trusted management networks or VPN clients until a fix is deployed.
• Place all /seller/** routes behind an authenticating reverse proxy that rejects requests lacking a valid session token.
• Audit product, order, and category tables for unauthorized changes since deployment of springboot-project v1.0.0.

Patch Information

No official vendor patch is referenced in the NVD entry for CVE-2026-79571 at the time of publication. Operators of springboot-project v1.0.0 should track the upstream repository for a corrected SellerAuthorizeAspect implementation. Refer to the GitHub PoC: Authentication Bypass writeup for endpoint identifiers that require immediate authorization hardening.

Workarounds

• Add an explicit HandlerInterceptor or Spring Security SecurityFilterChain rule that requires an authenticated seller role for every /seller/** path.
• Modify SellerAuthorizeAspect to throw an authorization exception when SecurityContextHolder.getContext().getAuthentication() returns null or an anonymous principal.
• Disable the seller-side module in production deployments that do not require it until a validated fix is available.

# Example Spring Security configuration snippet to enforce authentication on seller routes
# Add to your SecurityFilterChain bean
http
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/seller/**").hasRole("SELLER")
    .anyRequest().authenticated())
  .formLogin(Customizer.withDefaults());