CVE-2026-41720: Spring LDAP Authentication Bypass with Empty Password
Summary
CVE-2026-41720: Spring LDAP has Authentication Bypass with Empty Password. Affects org.springframework.ldap:spring-ldap-core across 4 version ranges.
< 2.4.4
>= 3.2.0, <= 3.2.16
>= 3.3.0, < 3.3.8
>= 4.0.0, < 4.0.4
Fixed in 2.4.4, 3.3.8 or 4.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Spring LDAP is a framework that provides a set of tools for integrating LDAP (Lightweight Directory Access Protocol) into Java applications. It simplifies the process of connecting to LDAP servers, managing directory entries, and performing authentication. The framework is widely used in enterprise applications for user management and authentication. However, certain versions of Spring LDAP are vulnerable to an authentication bypass issue when a non-empty username is paired with an empty or null password, which can lead to unauthorized access.
Vulnerability Detail
The vulnerability arises from the DirContextAuthenticationStrategy implementations in Spring LDAP, which do not properly validate the password field during authentication. This oversight allows attackers to authenticate using a valid username without providing a password, potentially granting them unauthorized access to sensitive resources. The affected versions range from 2.4.0 to 4.0.3, and the implications of this vulnerability can be severe, including unauthorized data access and manipulation.
How To Fix
Latest published version: 4.2.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4 -
>= 3.3.0, < 3.3.83.3.8 -
>= 4.0.0, < 4.0.44.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that your application does not allow authentication with an empty password. Implement additional validation checks in your authentication logic to reject any bind requests that contain an empty or null password.
Conclusion
In summary, CVE-2026-41720 represents a significant security risk for applications using vulnerable versions of Spring LDAP. It is essential to update to the latest patched versions to mitigate the risk of unauthorized access. Additionally, implementing temporary workarounds can help protect applications until an upgrade can be performed.
See every vulnerability recorded for org.springframework.ldap:spring-ldap-core →
FAQ
CVE-2026-41720 is a vulnerability in Spring LDAP that allows authentication bypass when a non-empty username is paired with an empty password.
Affected versions include Spring LDAP 2.4.0 through 2.4.4, 3.2.0 through 3.2.17, 3.3.0 through 3.3.7, and 4.0.0 through 4.0.3.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
If immediate upgrading is not possible, implement validation checks to prevent authentication with empty passwords as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.ldap:spring-ldap-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
