GitHub Advisoryadvisory · Maven

GHSA-hh3m-g4qj-4835 Spring Security Vulnerable to Authorization Bypass via Security Annotations

MEDIUM Published 2025-03-24 Modified 2025-03-24 Official page ↗
Aliases
CVE-2025-22223
Ecosystem
Maven
Packages
org.springframework.security:spring-security-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-290
Reviewed
2025-03-24

Affected packages

• Maven org.springframework.security:spring-security-core: >= 6.4.0, < 6.4.4 → fixed in 6.4.4

Description

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass.  You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or methods, or all method security annotations are attached to target methods

Related

Alias · CVE (1)

  • CVE-2025-22223 Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. vulnerability

Weakness · CWE (1)

  • CWE-290 Authentication Bypass by Spoofing weakness

References