Executive brief
Spring Security includes a test utility that runs an embedded LDAP directory server for testing authentication. This utility unconditionally creates and binds administrative credentials and listens on all network interfaces, making those credentials accessible to any user on the network who can reach the application. An attacker with network access to the affected application can connect to the LDAP server using the hardcoded administrative account and gain full control over the directory, potentially compromising authentication for the entire application.
Technical details
The vulnerability exists in the UnboundIdContainer test utility used within Spring Security, which automatically registers administrative LDAP credentials without requiring configuration and binds its listener to 0.0.0.0 (all network interfaces). The root cause is insufficient access control and overly permissive network binding defaults. An unauthenticated attacker on the network can connect directly to the LDAP server port (typically 389 or 636) and authenticate as the administrative user with a known or discoverable password, gaining full directory privileges. This is an authentication bypass vulnerability in the embedded test LDAP server component. Patches are available for all affected versions.
Affected products
- VMware Spring Security 5.7.0–5.7.25, 5.8.0–5.8.27, 6.4.0–6.4.18, 6.5.0–6.5.11, 7.0.0–7.0.6, 7.1.0
Timeline
- 2026-08-27: disclosed