PT-2026-48620 · Spring · Spring Web Services

Published 2026-06-11 · Updated 2026-06-11 · CVE-2026-40997

NVD

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2026-40997

Affected Products

Spring Web Services

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-40997 · Security Note
• https://spring.io/security/cve-2026-40997 · Note