CyberRota Analysis
AI-GeneratedSpring Security's DPoPProofJwtDecoderFactory is vulnerable to a cache-based replay attack, where attackers can exploit a strict size limit on the internal cache to evict legitimate JWT ID claims. This allows them to replay intercepted valid DPoP proofs, potentially compromising authentication mechanisms. Organizations using affected versions of Spring Security should prioritize remediation to mitigate the risk of unauthorized access.
Original NVD Description
Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs. This issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.