CVE-2026-41720: VMware Spring LDAP improper authentication in DirContextAuthenticationStrategy

CVE-2026-41720 · Severity: high · CVSS 7.4 · Published 2026-06-09

Spring LDAP is a library used by Java applications to communicate with directory services for user management and login. A security flaw allows attackers to bypass login screens by providing a valid username with an empty or null password. This could lead to unauthorized access to sensitive systems and data if the underlying directory service allows anonymous binds.

Technologies: org.springframework.ldap:spring-ldap-core (Maven). Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41720 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41720 being exploited in the wild.
How severe is CVE-2026-41720?
High severity, with a CVSS score of 7.4, published 9 June 2026.
Which products and versions are affected?
org.springframework.ldap:spring-ldap-core (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.4; VMware Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.
Is there a fix for CVE-2026-41720?
Yes. org.springframework.ldap:spring-ldap-core (Maven): upgrade to 4.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41720 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41720?
Check whether you run org.springframework.ldap:spring-ldap-core (Maven) or VMware Spring LDAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.ldap:spring-ldap-core (Maven): upgrade to 4.0.4 or later
    # set org.springframework.ldap:spring-ldap-core to 4.0.4 in your pom.xml or build.gradle

Technical details

An authentication bypass vulnerability exists in Spring LDAP's DirContextAuthenticationStrategy implementations. The root cause is the failure to validate and reject bind requests that contain a non-empty username but an empty or null password. In many LDAP configurations, providing a username with an empty password triggers an 'unauthenticated bind,' which the library may incorrectly interpret as a successful authentication. This allows a remote, unauthenticated attacker to bypass security controls if they know a valid username. The issue is addressed in versions 3.3.8 and 4.0.4 by explicitly rejecting empty passwords during the bind process.

Affected products

  • Spring Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3

Identifiers

  • CVE-2026-41720
  • GHSA-jrv5-8w28-4265

Timeline

  • 2026-06-09: disclosed
  • 2026-06-09: advisory
  • 2026-07-29: patched: Advisory updated with patch information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.