GitHub Advisoryadvisory · Maven

GHSA-37w2-q6vh-45v6 Spring gRPC AuthenticationException messages are reflected to remote client

LOW Published 2026-04-28 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-40969
Ecosystem
Maven
Packages
org.springframework.grpc:spring-grpc
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-209
Reviewed
2026-05-06

Affected packages

• Maven org.springframework.grpc:spring-grpc: < 1.0.3 → fixed in 1.0.3

Description

The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks. Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.

Related

Alias · CVE (1)

  • CVE-2026-40969 The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status… vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References