CVE-2026-41720: Authentication Bypass with Empty Password in Spring LDAP
Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password.
Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41720?
CVE-2026-41720 has a severity score of 7.4, indicating a high risk.
How do I fix CVE-2026-41720?
To fix CVE-2026-41720, upgrade to a version of Spring LDAP that is not affected, specifically versions 2.4.5, 3.2.18, 3.3.8, or 4.0.4 and above.
What versions of Spring LDAP are affected by CVE-2026-41720?
CVE-2026-41720 affects Spring LDAP versions 2.4.0 through 2.4.4, 3.2.0 through 3.2.17, 3.3.0 through 3.3.7, and 4.0.0 through 4.0.3.
What type of vulnerability is CVE-2026-41720?
CVE-2026-41720 is an authentication bypass vulnerability that allows a user to authenticate with a non-empty username and an empty password.
What impact does CVE-2026-41720 have on system security?
The impact of CVE-2026-41720 can lead to unauthorized access to system resources due to the failure to validate the password properly.