MEDIUM 5.3 Maven
Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide
GHSA-vqxh-445g-37fc · CVE-2025-22234
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.
Ready to move
Start Securing
Free, no credit card | First findings in minutes