CVE-2026-40997

Name of the Vulnerable Software and Affected Versions Spring Web Services versions 5.0.0 through 5.0.1 Spring Web Services versions 4.1.0 through 4.1.3 Spring Web Services versions 4.0.0 through 4.0.18 Spring Web Services versions 3.1.0 through 3.1.8

Description Integration paths between Spring WS and Spring Security may expose detailed account states, such as whether a user is locked or disabled, to remote SOAP clients. This occurs through exception messages or callback outcomes instead of returning generic authentication errors, allowing remote attackers to distinguish valid accounts from invalid ones and infer the account lifecycle state.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.