CVE-2026-41707: Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay
Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this replay issue?
Deployments using Spring Security's DPoPProofJwtDecoderFactory are affected in Spring Security 7.1.0, versions 7.0.0 through 7.0.6, and versions 6.5.0 through 6.5.11.
What must an attacker do to exploit the issue?
An attacker must flood the server with dummy requests to fill the strictly size-limited JWT ID cache and evict legitimate entries. They can then replay an intercepted valid DPoP proof whose JWT ID is no longer present in the cache.
Is authentication required for exploitation?
No. The supplied vector lists privileges required as none and user interaction as none, although exploitation has high attack complexity.