# CVE-2026-41720: VMware Spring LDAP improper authentication in DirContextAuthenticationStrategy

Source: https://junglewise.ai/threats/cve-2026-41720-vmware-spring-ldap-improper-authentication-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-41720 · Severity: high · CVSS 7.4 · Published 2026-06-09

Spring LDAP is a library used by Java applications to communicate with directory services for user management and login. A security flaw allows attackers to bypass login screens by providing a valid username with an empty or null password. This could lead to unauthorized access to sensitive systems and data if the underlying directory service allows anonymous binds.

Technologies: [org.springframework.ldap:spring-ldap-core (Maven)](https://junglewise.ai/threats/technologies/org-springframework-ldap-spring-ldap-core). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-41720 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41720 being exploited in the wild.

**How severe is CVE-2026-41720?** High severity, with a CVSS score of 7.4, published 9 June 2026.

**Which products and versions are affected?** org.springframework.ldap:spring-ldap-core (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.4; VMware Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.

**Is there a fix for CVE-2026-41720?** Yes. org.springframework.ldap:spring-ldap-core (Maven): upgrade to 4.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41720 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41720?** Check whether you run org.springframework.ldap:spring-ldap-core (Maven) or VMware Spring LDAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.ldap:spring-ldap-core (Maven): upgrade to 4.0.4 or later

  ```sh
  # set org.springframework.ldap:spring-ldap-core to 4.0.4 in your pom.xml or build.gradle
  ```


## Technical details

An authentication bypass vulnerability exists in Spring LDAP's DirContextAuthenticationStrategy implementations. The root cause is the failure to validate and reject bind requests that contain a non-empty username but an empty or null password. In many LDAP configurations, providing a username with an empty password triggers an 'unauthenticated bind,' which the library may incorrectly interpret as a successful authentication. This allows a remote, unauthenticated attacker to bypass security controls if they know a valid username. The issue is addressed in versions 3.3.8 and 4.0.4 by explicitly rejecting empty passwords during the bind process.

## Affected products

- Spring Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3

## Identifiers

- CVE-2026-41720
- GHSA-jrv5-8w28-4265

## Timeline

- 2026-06-09: disclosed
- 2026-06-09: advisory
- 2026-07-29: patched: Advisory updated with patch information

## References

- [https://spring.io/security/cve-2026-41720](https://spring.io/security/cve-2026-41720)
- [https://github.com/spring-projects/spring-ldap/issues/407](https://github.com/spring-projects/spring-ldap/issues/407)
- [https://github.com/spring-projects/spring-ldap/commit/30b90c9fb61af87208ed051fc31349ef4d418f75](https://github.com/spring-projects/spring-ldap/commit/30b90c9fb61af87208ed051fc31349ef4d418f75)
- [https://github.com/spring-projects/spring-ldap/commit/5cc73a6b7fb1d2bcb950c4d69221c6d192d79795](https://github.com/spring-projects/spring-ldap/commit/5cc73a6b7fb1d2bcb950c4d69221c6d192d79795)
- [https://github.com/spring-projects/spring-ldap/commit/e2748d44bdce4f6cb4663b9b8d8462e34808f09c](https://github.com/spring-projects/spring-ldap/commit/e2748d44bdce4f6cb4663b9b8d8462e34808f09c)

## Related threats

- [Spring LDAP data exposure vulnerability](https://junglewise.ai/threats/cve-2024-38829-spring-ldap-data-exposure-vulnerability)
- [Improper Authentication in Pivotal Spring-LDAP](https://junglewise.ai/threats/cve-2017-8028-improper-authentication-in-pivotal-spring-ldap)