Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state, which is a form of user enumeration and information disclosure at the security layer.

Preconditions include use of the affected callback handlers or helpers with username-token, digest, or X.509 validation paths where account status exceptions could propagate to the SOAP layer without uniform BadCredentialsException handling.