CVE-2022-22978: Authorization bypass in Spring Security
Summary
CVE-2022-22978: Authorization bypass in Spring Security. Affects org.springframework.security:spring-security-core across 3 version ranges.
< 5.4.11
>= 5.5.0, < 5.5.7
>= 5.6.0, < 5.6.4
Fixed in 5.4.11, 5.5.7 or 5.6.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is org.springframework.security:spring-security-core. This package is a part of the Spring Security framework, which provides authentication and authorization functionalities for Java applications. It is widely used to secure web applications and APIs. Spring Security Core is a core module of the framework that includes essential security features such as user authentication, access control, and session management. Unfortunately, versions 5.5.6 and 5.5.7, as well as older unsupported versions, are vulnerable to an authorization bypass.
Vulnerability Detail
The vulnerability in Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions is an authorization bypass. It stems from a misconfiguration of the RegexRequestMatcher, which can be easily bypassed on certain servlet containers. Applications that use RegexRequestMatcher with a regular expression containing a dot (.) are potentially vulnerable. This vulnerability allows attackers to bypass authorization checks and gain unauthorized access to protected resources. The impact of this vulnerability can be severe, as it compromises the security of the application and exposes sensitive data or functionality to unauthorized users.
How To Fix
Latest published version: 7.2.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.4.115.4.11 -
>= 5.5.0, < 5.5.75.5.7 -
>= 5.6.0, < 5.6.45.6.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended approach is to upgrade to a fixed version of Spring Security.
Conclusion
In conclusion, the vulnerability identified as CVE-2022-22978 in org.springframework.security:spring-security-core versions 5.5.6 and 5.5.7 and older unsupported versions is an authorization bypass. It allows attackers to bypass authorization checks and gain unauthorized access to protected resources. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of Spring Security and ensure the correct configuration of RegexRequestMatcher. Regularly updating dependencies and following secure coding practices is also essential. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
Spring Security is a framework that provides authentication and authorization functionalities for Java applications. It helps secure web applications and APIs by managing user authentication, access control, and session management.
This vulnerability allows attackers to bypass authorization checks and gain unauthorized access to protected resources. It compromises the security of the application and exposes sensitive data or functionality to unauthorized users.
Versions 5.5.6 and 5.5.7, as well as older unsupported versions, are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Spring Security. For versions 5.5.6 and 5.5.7, the fixed version is 5.5.7. For older unsupported versions, it is advised to upgrade to a supported version.
There is no specific workaround provided for this vulnerability. The recommended approach is to upgrade to a fixed version of Spring Security.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
