CVE-2026-22754
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability in Spring Security allows authorization rules to be bypassed when an application uses <sec:intercept-url servlet-path="..."/> to define the servlet path. The servlet path is not included in path matching, leading to authorization bypass.
Risk Assessment
The organization is at risk of unauthorized access to protected resources, potentially leading to data leakage or system integrity compromise.
Recommendation
Immediately update Spring Security to version 7.0.5 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Spring Security
See all- CVE-2014-0097High
The ActiveDirectoryLdapAuthenticator in Spring Security versions 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds, it may incorrectly authenticate a user who supplies an empty password.
- CVE-2026-59270Critical
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Affected versions include Spring Security 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, 6.4.0-6.4.18, 5.8.0-5.8.27, and 5.7.0-5.7.25.
- CVE-2026-59277Low
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as internal (private) or external (public). Affects Spring Security 7.1.0.
- CVE-2026-59276Medium
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.
- CVE-2026-47877High
Spring Security Authorization Server versions 7.1.0 and 7.0.0-7.0.6 are vulnerable because the default consent page renders user-controlled values without HTML entity encoding.
- CVE-2026-47842Medium
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Affected versions include Spring Security 5.7.0 through 7.1.0.
- CVE-2026-47841High
An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Affected versions: Spring Security 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, 6.4.0-6.4.18.
- CVE-2026-41707High
Authentication Bypass by Capture-replay vulnerability in Spring Security allows Spring Security's DPoPProofJwtDecoderFactory to contain a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.
- CVE-2026-47838Medium
The SubjectDnX509PrincipalExtractor in Spring Security does not correctly handle certain malformed X.509 certificate CN values, potentially reading the wrong username. A crafted certificate could allow an attacker to impersonate another user. Affected versions: 5.7.0-5.7.24, 5.8.0-5.8.26, 6.3.0-6.3.17, 6.4.0-6.4.17, 6.5.0-6.5.10.
- CVE-2026-41706Medium
A vulnerability in Spring Security's CookieRequestCache and CookieServerRequestCache stores the full absolute pre-authentication URL in a browser cookie. After login, the user is redirected to this URL without validation, enabling an open redirect attack.
Original NVD description (English source)
Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.