Spring Security vulnerabilities

CVE-2026-22733 [HIGH] CWE-288 CVE-2026-22733: Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3

CVE-2025-22234 [HIGH] CWE-208 Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.

CVE-2025-41232 [CRITICAL] CWE-693 CVE-2025-41232: Spring Security Aspects may not correctly locate method security annotations on private methods. Thi Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: * You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and * You have Spring Security method annotations on a privat

CVE-2025-22223 [MEDIUM] CWE-290 CVE-2025-22223: Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or methods, or all method security annotations are attache

CVE-2025-22228 [HIGH] CWE-287 CVE-2025-22228: BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

CVE-2024-38810 [MEDIUM] CWE-287 CVE-2024-38810: Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows at Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.

CVE-2024-22234 [HIGH] CWE-284 CVE-2024-22234: In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method. Specifically, an application is vulnerable if: * The application uses AuthenticationTrustResolver.isFullyAuthentic

CVE-2019-11272 [HIGH] CWE-287 CVE-2019-11272: Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text pass Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null

CVE-2019-3795 [MEDIUM] CWE-330 CVE-2019-3795: Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 cont Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker