Vmware Spring Web Services up to 3.1.8/4.0.18/4.1.3/5.0.1 authentication replay

Summaryinfo

A vulnerability marked as problematic has been reported in Vmware Spring Web Services up to 3.1.8/4.0.18/4.1.3/5.0.1. Impacted is an unknown function. Performing a manipulation results in authentication replay. This vulnerability was named CVE-2026-41000. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Vmware Spring Web Services up to 3.1.8/4.0.18/4.1.3/5.0.1. This affects an unknown code. The manipulation with an unknown input leads to a authentication replay vulnerability. CWE is classifying the issue as CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). This is going to have an impact on integrity. The summary by CVE is:

Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

The advisory is shared at spring.io. This vulnerability is uniquely identified as CVE-2026-41000 since 04/16/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/11/2026). MITRE ATT&CK project uses the attack technique T1040 for this issue.

Upgrading to version 3.1.9, 4.0.19, 4.1.4 or 5.0.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-36210). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Vmware

Name

• Spring Web Services

Version

• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6
• 3.1.7
• 3.1.8
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.0.10
• 4.0.11
• 4.0.12
• 4.0.13
• 4.0.14
• 4.0.15
• 4.0.16
• 4.0.17
• 4.0.18
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 5.0.0
• 5.0.1

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion