CVE-2026-41720: Spring LDAP Authentication Bypass via Empty Password (CVSS 7.4)

Technical summary

The vulnerability resides in Spring LDAP's DirContextAuthenticationStrategy implementations, which fail to properly reject bind requests where a non-empty username is combined with an empty or null password. During LDAP authentication, the strategy should enforce that both the username and password are present and valid; instead, it permits the bind operation to proceed. This represents a broken authentication check at the protocol level. The flaw affects versions 2.4.0–2.4.4, 3.2.0–3.2.17, 3.3.0–3.3.7, and 4.0.0–4.0.3 across the entire version tree, suggesting the defect was introduced early and persisted through multiple release cycles.

Business impact

Applications using affected Spring LDAP versions for authentication—particularly enterprise systems relying on LDAP as the primary directory and identity service—face unauthorized access risk. An attacker without valid credentials could bypass authentication entirely by submitting a known username paired with a blank password, potentially leading to data theft, unauthorized privilege escalation, or system compromise. The impact severity depends on the application's architecture; if LDAP authentication is the only factor or if the LDAP-authenticated user gains broad system access, the business impact is critical. Regulated environments (finance, healthcare, government) face additional compliance and audit implications.

Affected systems

Any application or service that directly uses Spring LDAP library versions 2.4.0–2.4.4, 3.2.0–3.2.17, 3.3.0–3.3.7, or 4.0.0–4.0.3 for LDAP authentication is vulnerable. This includes enterprise applications, single sign-on (SSO) integrations, and identity management systems built on Spring Framework that delegate authentication to LDAP directories. Java-based systems predominate. Developers should audit their dependency trees to identify exposed versions; transitive dependencies may hide the vulnerable library from initial inspection.

Exploitability

The vulnerability has a CVSS score of 7.4 (HIGH) with a network-accessible attack vector and no privileges required, indicating straightforward exploitability. However, the attack complexity is rated as high, meaning successful exploitation requires specific conditions—such as knowledge of valid usernames or the ability to enumerate them, or a particular LDAP server configuration. The attacker does not need to interact with an end user (no UI required). The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, though this does not diminish its risk. Proof-of-concept development and operational exploitation are likely inevitable once public awareness grows.

Remediation

Organizations must upgrade affected Spring LDAP installations to patched versions as soon as possible. Verify the specific patched version numbers against the official Spring Security and Spring LDAP project advisories, as patches have been released across the affected version lines. For interim mitigation, implement additional authentication controls: require multi-factor authentication (MFA) if possible, restrict LDAP authentication access to internal networks only, and enforce password policies in the LDAP directory that prevent null or empty values. However, these mitigations do not resolve the underlying authentication bypass and should not be considered substitutes for patching.

Patch guidance

Check the official Spring LDAP security advisory and GitHub releases for the exact patched version numbers corresponding to each affected version line (2.4.x, 3.2.x, 3.3.x, and 4.0.x). Update your Spring LDAP dependency in your build system (Maven pom.xml, Gradle build.gradle, etc.) to the first patched release in your version series. After upgrading, re-test your LDAP authentication flows to confirm the vulnerability is resolved and that no authentication-related regressions are introduced. If you use Spring Security (which may integrate Spring LDAP), ensure both libraries are updated in coordination.

Detection guidance

Search your codebase and dependency manifests for Spring LDAP versions within the affected ranges. Automated dependency scanning tools (such as OWASP Dependency-Check, Snyk, or JFrog Xray) should flag these versions automatically. Monitor LDAP server logs for successful bind operations with empty or null passwords—these entries would be suspicious and indicate active exploitation attempts. Application logs may show unexpected authentication successes with missing or blank password fields. Additionally, review deployment inventories and container image registries to identify production systems running the vulnerable library versions.

Why prioritize this

This vulnerability merits immediate prioritization because it directly undermines core authentication security. With a HIGH CVSS score, network accessibility, no authentication requirement, and the ability to grant unauthorized system access, it should be treated as a critical security risk. The broad version range affected (spanning multiple major release lines) means many organizations may unwittingly be running vulnerable code. The fact that it is not yet on CISA's KEV list does not reduce urgency; it reflects only that weaponized public exploitation has not yet been formally documented, not that the risk is low. Any system relying on LDAP for authentication should be remediated within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 7.4 reflects a HIGH-severity vulnerability that is network-reachable (AV:N), requires high attack complexity (AC:H), needs no prior privileges (PR:N), and doesn't require user interaction (UI:N). The vulnerability impacts the confidentiality and integrity of the system (C:H, I:H) but not availability (A:N). The high attack complexity rating acknowledges that successful exploitation may require knowledge of valid usernames or familiarity with the target LDAP configuration. However, the scope remains unchanged (S:U), meaning the impact is limited to the affected component itself, not the broader system environment. A score of 7.4 indicates a strong business driver for rapid patching.

Frequently asked questions