CVE-2026-41720: Authentication Bypass with Empty Password in Spring LDAP
Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password.
Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure DirContextAuthenticationStrategy implementations reject bind requests where a non-empty username is paired with an empty or null password (i.e., modify the authentication logic to treat empty or null passwords as invalid and deny the bind).
Spring LDAP DirContextAuthenticationStrategy implementations reject_empty_or_null_password = true
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41720?
CVE-2026-41720 has a severity score of 7.4, indicating a high risk.
How do I fix CVE-2026-41720?
To fix CVE-2026-41720, upgrade to a version of Spring LDAP that is not affected, specifically versions 2.4.5, 3.2.18, 3.3.8, or 4.0.4 and above.
What versions of Spring LDAP are affected by CVE-2026-41720?
CVE-2026-41720 affects Spring LDAP versions 2.4.0 through 2.4.4, 3.2.0 through 3.2.17, 3.3.0 through 3.3.7, and 4.0.0 through 4.0.3.
What type of vulnerability is CVE-2026-41720?
CVE-2026-41720 is an authentication bypass vulnerability that allows a user to authenticate with a non-empty username and an empty password.
What impact does CVE-2026-41720 have on system security?
The impact of CVE-2026-41720 can lead to unauthorized access to system resources due to the failure to validate the password properly.