Versions 7.0.0 to 7.0.4 of the Spring Security OAuth server allow a sign‑up feature to accept unsafe information from a new app.

The built‑in LDAP service in Spring Security automatically creates an admin account and makes it reachable from any network address.

Hi, Spring fans! In this episode, I talk Spring Security’s Joe Grandja about Spring Authorization Server’s graduation into Spring Security 7, and the new security heavyweights DPoP and PAR.

Spring Securityに組み込まれたUnboundID LDAPサーバーに、重大な脆弱性が確認されました。ゼロデイ脆弱性アラート この脆弱性を悪用すると、リモート攻撃者が広く知られた管理者用bind DNを使って認証を突破し、アプリケーションのインメモリLDAPディレクトリに保存されたデータを読み取ったり改ざ

TL;DR VMware disclosed four Spring Security vulnerabilities. The most severe, CVE-2026-59270, rates CVSS 9.4 (CRITICAL). Its embedded LDAP server exposes an admin bind DN on all interfaces, letting an attacker read or modify entries in the in-memory directory. No exploitation in the wild or public proof-of-concept has been confirmed. Why These Spring Security Vulnerabilities Matter Spring Security guards authentication for countless Java applications.

This vulnerability in Spring Security Spring Authorization Server enables authentication bypass due to a primary weakness. It affects versions 7.0.0 to 7.0.4, 1.5.0 to 1.5.6, 1.4.0 to 1.4.9, and 1.3.0 to 1.3.10. The CVSS 3.1 base score is 9

An issue in the Spring Authorization Server allows attackers to bypass authentication by exploiting a weakness in how it validates client data.

Enterprise Java security has changed significantly in the last two months. A massive 1,766% increase in Spring security reports, combined with AI-powered cyberattacks, has made traditional "wait-and-p...

Open source end-of-life (EOL) packages are frequently omitted from CVE investigations and vulnerability feeds, leaving millions of versions unflagged and enterprises exposed. Industry research from HeroDevs and Sonatype shows 5.4M EOL package versions across major registries and finds that AI-driven discovery like Project Glasswing may increase uncovered vulnerabilities in unmaintained code. #SpringSecurity #ProjectGlasswing