Skip to content
fr Sign in
5.3 Medium

CVE-2025-22223 Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods

Description

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass.  You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or methods, or all method security annotations are attached to target methods

Affected products and versions

Product Affected versions Fixed in
Spring Security 6.4.0-6.4.3 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring Security

The 29 CVEs of Spring Security →
CVE-2026-59277 Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing… 3.7 Low CVE-2026-59276 Several components in Spring Security compare security-sensitive values using standard string equality (String.equals())… 5.9 Medium CVE-2026-59270 Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative… 9.4 Critical CVE-2026-47877 Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding 8.2 High
Track this CVE