# CVE-2026-71575: Spring Security OIDC authentication freshness bypass in OidcClientCodeRequestFilter

Source: https://junglewise.ai/threats/cve-2026-71575-the-max-age-authentication-freshness-check-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-71575 · Severity: critical · CVSS 9.1 · Published 2026-10-09

Spring Security's OIDC authentication component failed to properly enforce re-authentication policies due to a time unit conversion bug and inverted logic check. An attacker could reuse old sessions indefinitely, bypassing security policies that require step-up authentication for sensitive operations, potentially leading to unauthorized access to protected resources.

Vendors: [Spring](https://junglewise.ai/threats/vendors/spring).

## Quick answers

**Is CVE-2026-71575 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71575 being exploited in the wild.

**How severe is CVE-2026-71575?** Critical severity, with a CVSS score of 9.1, published 9 October 2026.

**Which products and versions are affected?** Spring Security prior to 4.2.4, 4.1.9, and 3.6.13.

**Is there a fix for CVE-2026-71575?** Yes: fixed in Spring Security 4.2.4, 4.1.9, 3.6.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71575 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-71575?** Check whether you run Spring Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Spring Security 4.2.4, 4.1.9, 3.6.13

## Technical details

The max_age authentication-freshness check in OidcClientCodeRequestFilter contained two bugs: a milliseconds-to-seconds unit mismatch and inverted comparison polarity. This made the security check ineffective, allowing any session age to pass validation even when setMaxAgeOffset was configured to enforce reauthentication. The vulnerability affects all relying parties using this mechanism and requires only network access to the OIDC endpoint.

## Affected products

- Spring Spring Security prior to 4.2.4, 4.1.9, and 3.6.13

## Timeline

- 2026-10-09: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread/p1r9t4xl8ny7rg8wmj8nrygx35ds6vcs](https://lists.apache.org/thread/p1r9t4xl8ny7rg8wmj8nrygx35ds6vcs)