cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation

This is a continuation of CVE-2020-5408 . Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Because the IV is fixed, identical plaintexts always produce identical ciphertext for a given password and salt, regardless of when or how many times the value was encrypted. An attacker with read access to the encrypted data store can exploit this property to determine when two records share the same plaintext value, correlate encrypted values…

Spring Security Advisoriesで読む