Skip to content
Sign in
3.7 Low

CVE-2026-40969 The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the…

Description

The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks. Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.

Affected products and versions

Product Affected versions Fixed in
Spring gRPC 1.0 1.0.0 → < 1.0.3 1.0.3

Other CVEs of Spring gRPC

The 2 CVEs of Spring gRPC →
CVE-2026-40968 When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC… 4.3 Medium
Track this CVE