Executive brief
Spring Web Services is a framework for building SOAP-based web services with security features. The Wss4jSecurityInterceptor component failed to properly use configured replay cache protections during validation, allowing attackers to replay previously captured authentication tokens and timestamps to bypass security controls even when a replay cache was configured by the operator.
Technical details
The vulnerability is an authentication bypass through capture-replay attacks (CWE-294) affecting the Wss4jSecurityInterceptor in Spring Web Services. The root cause is that Apache WSS4J ReplayCache instances are not consistently wired into RequestData during validation-time security checks. This means that configured replay protections against UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics are ineffective. An attacker with network access can capture valid SOAP security headers and replay them to the server, bypassing token and timestamp validation controls. The vulnerability requires the ability to intercept and replay network traffic but does not require user interaction or elevated privileges. Patches are available for versions 5.0.2 and later; versions 4.1.4 and later for the 4.1.x branch; no patch information is available for 4.0.x and 3.1.x branches.
Affected products
- SpringSource Spring Web Services 5.0.0 through 5.0.1
- SpringSource Spring Web Services 4.1.0 through 4.1.3
- SpringSource Spring Web Services 4.0.0 through 4.0.18
- SpringSource Spring Web Services 3.1.0 through 3.1.8
Timeline
- 2026-06-11: disclosed: Published to GitHub Advisory Database and NVD
- 2026-08-21: advisory: GitHub reviewed advisory
- 2026-06-11: patched: Patches released for versions 5.0.2 and 4.1.4