Launch Week Day 1: Announcing Security Design Review
MEDIUM 5.3 Maven

Spring Security Vulnerable to Authorization Bypass via Security Annotations

GHSA-hh3m-g4qj-4835 · CVE-2025-22223

Published · Modified

Description

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. 

You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or methods, or all method security annotations are attached to target methods

Ready to move

Start Securing

Free, no credit card | First findings in minutes