CVE-2025-41232
published 2025-05-21CVE-2025-41232: Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may…
PriorityP353critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.53%
41.5th percentile
Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: * You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and * You have Spring Security method annotations on a private method In that case, the target method may be able to be invoked without proper authorization. You are not affected if: * You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or * You have no Spring Security-annotated private methods
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_security | >= 6.4.x < 6.4.6 | 6.4.6 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Spring Security authorization bypass for method security annotations on private methods
osv·2025-05-21
CVE-2025-41232 [CRITICAL] Spring Security authorization bypass for method security annotations on private methods
Spring Security authorization bypass for method security annotations on private methods
Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.
Your application may be affected by this if the following are true:
* You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and
* You have Spring Security method annotations on a private method
In that case, the target method may be able to be invoked without proper authorization.
You are not affected if:
* You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or
* You have no Spring Security-annotated private methods
GHSA
Spring Security authorization bypass for method security annotations on private methods
ghsa·2025-05-21
CVE-2025-41232 [CRITICAL] CWE-693 Spring Security authorization bypass for method security annotations on private methods
Spring Security authorization bypass for method security annotations on private methods
Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.
Your application may be affected by this if the following are true:
* You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and
* You have Spring Security method annotations on a private method
In that case, the target method may be able to be invoked without proper authorization.
You are not affected if:
* You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or
* You have no Spring Security-annotated private methods
Red Hat
Spring-Security: Spring Security authorization bypass for method security annotations on private methods
vendor_redhat·2025-05-21·CVSS 9.1
CVE-2025-41232 [CRITICAL] CWE-306 Spring-Security: Spring Security authorization bypass for method security annotations on private methods
Spring-Security: Spring Security authorization bypass for method security annotations on private methods
Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.
Your application may be affected by this if the following are true:
* You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and
* You have Spring Security method annotations on a private method
In that case, the target method may be able to be invoked without proper authorization.
You are not affected if:
* You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or
* You have no Spring Security-annotated private methods
A flaw was found in Spring Security Aspects. Affected versions of this package ar
No detection rules found.
No public exploits indexed.
2025-05-21
Published