Spring Security's DPoPProofJwtDecoderFactory stores JWT ID claims in a size‑limited cache. When the cache becomes full, older entries are removed, allowing an attacker to induce eviction by flooding the server with dummy DPoP requests. After legitimate entries are evicted, the attacker can replay an intercepted valid DPoP proof, effectively bypassing authentication and accessing protected resources. This vulnerability is a classic authentication bypass via capture‑and‑replay, linked to CWE‑294.

The vulnerability affects Spring Security products from version 6.5.0 to 6.5.11, from 7.0.0 to 7.0.6, and the 7.1.0 release. All deployments that rely on the DPoPProofJwtDecoderFactory component are potentially impacted.

The vulnerability has a CVSS score of 7.4, indicating a high impact if exploited. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker sending a high volume of crafted DPoP requests to trigger cache eviction, inferred from the description. Once eviction has occurred, the attacker can reuse a captured proof to trigger authorization for protected endpoints.