GHSA-8hfc-fq58-r658 Spring Boot has an Authentication Bypass under Actuator Health groups paths

• Maven org.springframework.boot:spring-boot-starter-actuator: >= 3.4.0, <= 3.4.13 (no fix yet) • Maven org.springframework.boot:spring-boot-starter-actuator: >= 3.5.0, < 3.5.12 → fixed in 3.5.12 • Maven org.springframework.boot:spring-boot-starter-actuator: >= 4.0.0-M1, < 4.0.4 → fixed in 4.0.4

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.