~ / search / GHSA-hh3m-g4qj-4835

GHSA-hh3m-g4qj-4835

Spring Security Vulnerable to Authorization Bypass via Security Annotations

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-22223

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework.security:spring-security-core >= 6.4.0, < 6.4.4 6.4.4

Details

As written in the advisory (Markdown source, shown as plain text).

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass.  You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or methods, or all method security annotations are attached to target methods

References

External links from the advisory. They lead to third-party sites.