Spring Security’s embedded UnboundID LDAP server automatically registers a default administrative credential and binds to all network interfaces. This exposure allows attackers to discover the well‑known bind DN and gain administrative access to the LDAP directory. This privileged access can compromise confidentiality, integrity, and availability of directory data and all services that rely on it.

Affected releases include Spring Security 7.1.0, 7.0.0‑7.0.6, 6.5.0‑6.5.11, 6.4.0‑6.4.18, 5.8.0‑5.8.27, and 5.7.0‑5.7.25. The vulnerability resides in the UnboundID LDAP integration bundled with these versions.

The CVSS score of 9.4 indicates high severity. The EPSS score of < 1% indicates a low but non‑zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the exposed administrative DN over any network interface the server listens on, making local or remote network compromise a realistic threat. Lacking additional authentication controls, an attacker with network reach can perform LDAP administration without further credentials.