Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass.
You are not affected if you are not using @EnableMethodSecurity, or
you do not have method security annotations on parameterized types or methods, or all method security annotations are attached to target methods
References
| Link | Resource |
|---|---|
| https://spring.io/security/cve-2025-22223 |
Configurations
No configuration.
History
No history.
Information
Published : 2025-03-24 18:15
Updated : 2025-03-27 16:45
NVD link : CVE-2025-22223
Mitre link : CVE-2025-22223
CVE.ORG link : CVE-2025-22223
JSON object : View
Products Affected
No product.
CWE
CWE-290
Authentication Bypass by Spoofing