The Wss4jSecurityInterceptor incorrectly initializes its BSP compliance flag, disabling WSS4J Basic Security Profile enforcement on inbound requests. Because of this, services that rely on WS‑Security and expect strict BSP validation may accept messages that violate protocol rules, weakening security controls. This gap can allow attackers to craft messages that bypass validation, potentially leading to unauthorized actions or data compromise. The weakness is classified as CWE‑1188.

Spring Web Services (Spring:Spring Web Services) is affected. Affected versions include 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; and 3.1.0 through 3.1.8.

The CVSS score is 8.2, indicating a high severity. The EPSS score is not available, making it unclear how often the vulnerability is actively exploited, but the problem can be mitigated if a patch is applied. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can exploit the disabled BSP validation by sending crafted SOAP messages that violate protocol rules, potentially to gain a foothold or perform unauthorized operations.