## cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

- 種別: advisory
- 重大度: high
- 関連技術: spring, java
- CVE: CVE-2026-41707
- 公開日時: 2026-08-20T00:00:00.000Z
- 情報源: Spring Security Advisories (https://spring.io/security/cve-2026-41707)
- パーマリンク: https://vulnpulse.app/items/spring-security-459b975b7d39

Spring Security's DPoPProofJwtDecoderFactory uses an internal cache to store the processed jti (JWT ID) claims, which is intended to protect against replay attacks by ensuring that each DPoP proof is only used once. However, this cache has a strict maximum size limit of entries. If the attacker is able to intercept a legitimate user's valid DPoP proof, they can flood the server with dummy requests to forcefully evict the legitimate jti from the cache. Once the jti is evicted, the attacker can successfully replay the intercepted valid DPoP proof, leading to unauthorized access and impersonatio…