Vmware Spring LDAP up to 2.4.4/3.2.17/3.3.7/4.0.3 improper authentication

Summaryinfo

A vulnerability labeled as critical has been found in Vmware Spring LDAP up to 2.4.4/3.2.17/3.3.7/4.0.3. This impacts an unknown function. Executing a manipulation can lead to improper authentication. This vulnerability is registered as CVE-2026-41720. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Vmware Spring LDAP up to 2.4.4/3.2.17/3.3.7/4.0.3 and classified as critical. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.

The advisory is shared for download at spring.io. This vulnerability was named CVE-2026-41720 since 04/22/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/24/2026).

Upgrading to version 2.4.5, 3.2.18, 3.3.8 or 4.0.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-35324). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Directory Service Software

Vendor

• Vmware

Name

• Spring LDAP

Version

• 2.4.0
• 2.4.1
• 2.4.2
• 2.4.3
• 2.4.4
• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 3.2.7
• 3.2.8
• 3.2.9
• 3.2.10
• 3.2.11
• 3.2.12
• 3.2.13
• 3.2.14
• 3.2.15
• 3.2.16
• 3.2.17
• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.3.5
• 3.3.6
• 3.3.7
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion