CVE-2026-41000: broadcom spring_web_services Authentication Bypass by Capture-replay
Vulnerability summary
CVE-2026-41000 is a low (CVSS 3.7) Authentication Bypass by Capture-replay vulnerability in broadcom spring_web_services. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.9% of scored vulnerabilities.
Timeline
- 11-06-2026PublishedVulnerability first disclosed.
- 23-06-2026Last modifiedVulnerability information updated.
Description
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · MavenEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- NVDNIST3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
+0.04 pp
From 0.22% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Broadcom1 product
- spring_web_services< 3.1.9 | ≥ 4.0.0, < 4.0.19 | ≥ 4.1.0, < 4.1.3.1 | ≥ 5.0.0, < 5.0.1.1
Org.springframework.ws1 product
- spring-ws-security≥ 5.0.0, < 5.0.2 | ≥ 4.1.0, < 4.1.4 | ≥ 4.0.0, ≤ 4.0.18 | ≥ 3.1.0, ≤ 3.1.8
Spring1 product
- spring web services≥ 5.0.0, < 5.0.1.1 | ≥ 4.1.0, < 4.1.3.1 | ≥ 4.0.0, < 4.0.19 | ≥ 3.1.0, < 3.1.9
3 vendors · 3 products
