Description

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state, which is a form of user enumeration and information disclosure at the security layer.

Preconditions include use of the affected callback handlers or helpers with username-token, digest, or X.509 validation paths where account status exceptions could propagate to the SOAP layer without uniform BadCredentialsException handling.

Affected Spring Products and Versions

Spring Web Services:

• 5.0.0 - 5.0.1
• 4.1.0 - 4.1.3
• 4.0.0 - 4.0.18
• 3.1.0 - 3.1.8

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

References

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N&version=3.1

History

• 2026-06-10: Initial vulnerability report published.