Junglewise Threat Intelligence

CVE-2026-41720: VMware Spring LDAP improper authentication in DirContextAuthenticationStrategy

CVE-2026-41720 · Severity: high · CVSS 7.4 · Published 2026-06-09

Vendors: Spring, VMware.

Executive brief

Spring LDAP is a library used by Java applications to communicate with directory services for user management and login. A security flaw allows attackers to bypass login screens by providing a valid username with an empty or null password. This could lead to unauthorized access to sensitive systems and data if the underlying directory service allows anonymous binds.

Technical details

An authentication bypass vulnerability exists in Spring LDAP's DirContextAuthenticationStrategy implementations. The root cause is the failure to validate and reject bind requests that contain a non-empty username but an empty or null password. In many LDAP configurations, providing a username with an empty password triggers an 'unauthenticated bind,' which the library may incorrectly interpret as a successful authentication. This allows a remote, unauthenticated attacker to bypass security controls if they know a valid username. The issue is addressed in versions 3.3.8 and 4.0.4 by explicitly rejecting empty passwords during the bind process.

Affected products

  • Spring Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3

Timeline

  • 2026-06-09: disclosed
  • 2026-06-09: advisory
  • 2026-07-29: patched: Advisory updated with patch information

References