cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

Spring Security's DPoPProofJwtDecoderFactory uses an internal cache to store the processed jti (JWT ID) claims, which is intended to protect against replay attacks by ensuring that each DPoP proof is only used once. However, this cache has a strict maximum size limit of entries. If the attacker is able to intercept a legitimate user's valid DPoP proof, they can flood the server with dummy requests to forcefully evict the legitimate jti from the cache. Once the jti is evicted, the attacker can successfully replay the intercepted valid DPoP proof, leading to unauthorized access and impersonatio…

在 Spring Security Advisories 阅读

2026/08/20 09:00，Spring Security Advisories 发布了“cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Spring、Java。CVE：CVE-2026-41707。