CVE-2024-22257: Erroneous authentication pass in Spring Security
Summary
CVE-2024-22257: Erroneous authentication pass in Spring Security. Affects org.springframework.security:spring-security-core across 4 version ranges.
< 5.7.12
>= 5.8.0, < 5.8.11
>= 6.0.0, < 6.1.8
>= 6.2.0, < 6.2.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Security is a powerful and widely used framework for securing Java applications. It provides comprehensive authentication and authorization capabilities, allowing developers to protect their applications from unauthorized access. However, a vulnerability has been discovered in versions 5.7.x to 5.7.12, 5.8.x to 5.8.11, 6.0.x to 6.0.9, 6.1.x to 6.1.8, and 6.2.x to 6.2.3 of the 'org.springframework.security:spring-security-core' package. This vulnerability can lead to broken access control when the AuthenticatedVoter#vote method is used with a null Authentication parameter.
Vulnerability Detail
The vulnerability arises when an application directly uses the AuthenticatedVoter#vote method and passes a null Authentication parameter. In such cases, the method erroneously returns true, indicating that the user is authenticated and authorized. This can lead to unauthorized access to protected resources and a potential security breach. It is important to note that AuthenticatedVoter has been deprecated since version 5.8, and it is recommended to use implementations of AuthorizationManager instead.
How To Fix
Latest published version: 7.2.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.7.125.7.12 -
>= 5.8.0, < 5.8.115.8.11 -
>= 6.0.0, < 6.1.86.1.8 -
>= 6.2.0, < 6.2.36.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the package is not immediately feasible, a temporary workaround can be implemented. Instead of using AuthenticatedVoter directly, developers can utilize other authorization mechanisms provided by Spring Security, such as AuthorizationManager implementations. By avoiding the use of AuthenticatedVoter and passing null Authentication parameters, the vulnerability can be mitigated. Here's an example of using the PreAuthorize annotation with a custom AuthorizationManager:
import org.springframework.security.access.prepost.PreAuthorize;
@PreAuthorize("hasRole('ROLE_ADMIN')")
public void protectedMethod() {
// Code for the protected method
}
In this example, the protectedMethod() will only be accessible to users with the 'ROLE_ADMIN' role.
Conclusion
In conclusion, the 'org.springframework.security:spring-security-core' package is vulnerable to broken access control when using the deprecated AuthenticatedVoter class with a null Authentication parameter. To mitigate this vulnerability, it is essential to upgrade to the recommended versions and avoid using AuthenticatedVoter directly. Additionally, developers can utilize other authorization mechanisms provided by Spring Security, such as AuthorizationManager implementations. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
The vulnerability can lead to broken access control, allowing unauthorized users to gain access to protected resources within the application.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
Yes, the CVSS score for this vulnerability is 8.2, indicating a high severity level.
No, AuthenticatedVoter has been deprecated since version 5.8 of Spring Security. It is recommended to use implementations of AuthorizationManager as a replacement.
At the time of this advisory, there are no known exploits for this vulnerability. However, it is crucial to apply the recommended fixes to prevent any potential security breaches.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
