cbcvebase.

Spring Security vulnerabilities

21 known vulnerabilities affecting spring/spring_security.

Total CVEs
21
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH11MEDIUM8LOW1

Vulnerabilities

Page 2 of 2
CVE-2026-22746P4LOWCVSS 3.7≥ 5.7.0, ≤ 5.7.22≥ 5.8.0, ≤ 5.8.24+3 more2026-04-22
CVE-2026-22746 [LOW] CWE-208 CVE-2026-22746: Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAc Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.
nvd
← Previous2 / 2
Spring Security vulnerabilities | cvebase