cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

Spring Security's DPoPProofJwtDecoderFactory uses an internal cache to store the processed jti (JWT ID) claims, which is intended to protect against replay attacks by ensuring that each DPoP proof is only used once. However, this cache has a strict maximum size limit of entries. If the attacker is able to intercept a legitimate user's valid DPoP proof, they can flood the server with dummy requests to forcefully evict the legitimate jti from the cache. Once the jti is evicted, the attacker can successfully replay the intercepted valid DPoP proof, leading to unauthorized access and impersonatio…

Spring Security Advisoriesで読む

2026/08/20 09:00、Spring Security Advisoriesが「cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Spring、Java。CVE: CVE-2026-41707。