This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-41000 | BDVDB-2026-339740 Detail

SpringSpring Web Services

Description#

Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Impact#

Attackers can re-submit still-valid cryptographic material within the acceptance window because WSS4J ReplayCache instances are not consistently wired into RequestData for validation-time checks even when configured.

Weaknesses#

  • CWE-294 Authentication Bypass by Capture-replay

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.