CVE-2026-40997: Spring Web Services Account Enumeration via Error Message Disclosure

Technical summary

The vulnerability stems from insufficient error handling in Spring WS authentication flows when integrated with Spring Security. Specifically, exception messages and callback outcomes that propagate to remote SOAP clients can disclose account state semantics (locked, disabled, nonexistent) instead of abstracting them behind uniform authentication failures. The root cause is CWE-209 (Information Exposure Through an Error Message), where granular account information leaks via SOAP faults or response metadata. Affected versions include Spring WS 5.0.0–5.0.1, 4.1.0–4.1.3, 4.0.0–4.0.18, and 3.1.0–3.1.8.

Business impact

Account enumeration attacks become feasible without authentication barriers, increasing reconnaissance efficiency for threat actors. This can accelerate targeted brute-force campaigns or social engineering by confirming which email addresses or usernames belong to legitimate accounts. For organizations operating SOAP services, the reputational and compliance risk lies in exposing user identity metadata beyond intended API consumers. While the vulnerability does not grant unauthorized access, it substantially lowers the cost of account discovery.

Affected systems

Any deployment using Spring Web Services versions 5.0.0 through 5.0.1, 4.1.0 through 4.1.3, 4.0.0 through 4.0.18, or 3.1.0 through 3.1.8 with Spring Security integration is at risk. Exposure is specific to SOAP authentication endpoints; REST or non-WS integration paths are unaffected. Organizations running older Long-Term Support (LTS) versions of Spring WS should prioritize assessment, as many remain in active maintenance.

Exploitability

Exploitation requires only network access to a SOAP endpoint and no authentication credentials. An attacker can submit login attempts and observe whether error responses reveal account existence or state. The attack is passive reconnaissance—no special tools, payloads, or kernel exploits are needed. The CVSS score of 5.3 reflects low confidentiality impact (information disclosure only), no integrity or availability damage, and a straightforward attack vector. However, the ease of execution and the foundation it provides for follow-on attacks elevate practical concern.

Remediation

Upgrade to patched versions: Spring WS 5.0.2 or later, 4.1.4 or later, 4.0.19 or later, or 3.1.9 or later. Patched releases normalize authentication error responses to mask account state differences. If immediate patching is infeasible, implement network-layer controls to restrict SOAP endpoint access to trusted clients or apply a Web Application Firewall (WAF) rule to scrub verbose error messages from responses before they reach external clients.

Patch guidance

Spring Web Services maintains four active release tracks. Consult the official Spring WS advisory and security documentation to confirm patch availability for your version line. Patches are expected to be available in the minor version increments immediately following the latest affected version in each track. Test patches in a staging environment that mirrors your SOAP service configuration and integrations before deploying to production. Pay special attention to any custom error handlers or callbacks that may override the default Spring Security authentication behavior.

Detection guidance

Monitor SOAP authentication failure logs and responses for variance in error messages tied to different account states. If logs or response metadata reveal patterns like 'User locked', 'User disabled', or 'User not found', your system is likely vulnerable. Review SOAP fault strings and HTTP headers in authentication responses. Security scanning tools capable of SOAP protocol analysis can detect account enumeration patterns by submitting multiple login attempts and correlating response differences. Log and alert on unusual SOAP authentication probing patterns.

Why prioritize this

Although the CVSS score is moderate (5.3), the vulnerability enables efficient account enumeration—a critical first step in targeted attacks. Organizations with SOAP APIs, particularly in financial services, healthcare, or high-security environments, should deprioritize based purely on CVSS and instead consider business context. The ease of exploitation and the foundational reconnaissance value make this a worthwhile target for Q3 2026 patch cycles. Enterprises relying on SOAP security posture should treat this as a high-priority application-level patch.

Risk score, explained

CVSS 5.3 (Medium) reflects the constraint that information disclosure alone cannot cause system compromise, data theft, or service disruption. However, the vector (Network / Low Complexity / No Privileges / No User Interaction) underscores how trivially the vulnerability can be triggered. The true risk is contextual: for organizations with large user bases or public SOAP APIs, account enumeration at scale can identify high-value targets for credential stuffing or phishing. Risk assessment should incorporate threat modeling around SOAP service visibility and the sensitivity of account metadata.

Frequently asked questions