Critical Spring Security LDAP Flaw Lets Remote Attackers Read and Modify Directory Data

A critical vulnerability has been identified in the embedded UnboundID LDAP server within Spring Security. This flaw could allow remote attackers to authenticate using a well-known administrative bind DN, granting them the ability to read or modify data stored in an application’s in-memory LDAP directory. This issue, tracked as CVE-2026-59270, was...