CVE-2024-22257
HighCVSS 8.2Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A vulnerability in Spring Security allows bypassing access control when the application directly calls the AuthenticatedVoter#vote method with a null Authentication parameter. Affected versions are 5.7.x up to 5.7.11, 5.8.x up to 5.8.10, 6.0.x up to 6.0.8, 6.1.x up to 6.1.7, and 6.2.x up to 6.2.2.
Risk Assessment
The organization is at risk of unauthorized access to resources, potentially leading to data confidentiality or integrity breaches if authentication is improperly handled.
Recommendation
Immediately upgrade Spring Security to versions 5.7.12, 5.8.11, 6.0.9, 6.1.8, or 6.2.3 depending on the branch in use. Also review application code for direct use of AuthenticatedVoter#vote with null.
Other vulnerabilities in Spring Security
See all- CVE-2014-0097High
The ActiveDirectoryLdapAuthenticator in Spring Security versions 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds, it may incorrectly authenticate a user who supplies an empty password.
- CVE-2026-59270Critical
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Affected versions include Spring Security 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, 6.4.0-6.4.18, 5.8.0-5.8.27, and 5.7.0-5.7.25.
- CVE-2026-59277Low
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as internal (private) or external (public). Affects Spring Security 7.1.0.
- CVE-2026-59276Medium
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.
- CVE-2026-47877High
Spring Security Authorization Server versions 7.1.0 and 7.0.0-7.0.6 are vulnerable because the default consent page renders user-controlled values without HTML entity encoding.
- CVE-2026-47842Medium
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Affected versions include Spring Security 5.7.0 through 7.1.0.
- CVE-2026-47841High
An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Affected versions: Spring Security 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, 6.4.0-6.4.18.
- CVE-2026-41707High
Authentication Bypass by Capture-replay vulnerability in Spring Security allows Spring Security's DPoPProofJwtDecoderFactory to contain a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.
- CVE-2026-47838Medium
The SubjectDnX509PrincipalExtractor in Spring Security does not correctly handle certain malformed X.509 certificate CN values, potentially reading the wrong username. A crafted certificate could allow an attacker to impersonate another user. Affected versions: 5.7.0-5.7.24, 5.8.0-5.8.26, 6.3.0-6.3.17, 6.4.0-6.4.17, 6.5.0-6.5.10.
- CVE-2026-41706Medium
A vulnerability in Spring Security's CookieRequestCache and CookieServerRequestCache stores the full absolute pre-authentication URL in a browser cookie. After login, the user is redirected to this URL without validation, enabling an open redirect attack.
Original NVD description (English source)
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.