A flaw in several Spring Web Services integration paths with Spring Security can expose detailed account state, such as locked or disabled status, to remote SOAP clients via exception messages or callback results instead of generic authentication errors. This behavior, identified as CWE-209, allows an attacker to confirm whether a particular username exists and infer its lifecycle state, enabling targeted social engineering or credential-based attacks.

Spring Web Services versions 5.0.0 to 5.0.1, 4.1.0 to 4.1.3, 4.0.0 to 4.0.18, and 3.1.0 to 3.1.8 are impacted.

The vulnerability carries a CVSS score of 5.3 and has no available EPSS score or KEV listing. Exploitation requires a remote SOAP client to trigger authentication logic that surfaces detailed faults, which is plausible for any reachable SOAP endpoint. The attack vector is inferred to be remote over SOAP, and the risk is moderate due to the lack of a zero‑day exploit but a clear pathway for account enumeration and potential escalation.