CVE-2025-41232: Spring Security Aspects Authorization Bypass on Private Methods
Summary
CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods. Affects org.springframework.security:spring-security-aspects versions >= 6.4.0, < 6.4.6. Fixed in 6.4.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Security is a powerful and customizable authentication and access control framework for Java applications. It provides comprehensive security services for Java EE-based enterprise software applications. The 'spring-security-aspects' package allows developers to apply security annotations to methods, enabling fine-grained access control. However, a vulnerability exists in the way method security annotations are processed for private methods, potentially leading to unauthorized access.
Vulnerability Detail
The vulnerability arises from Spring Security's inability to correctly locate method security annotations on private methods when using the @EnableMethodSecurity annotation with the ASPECTJ mode. This flaw can lead to an authorization bypass, allowing unauthorized users to invoke private methods that should be protected by security annotations. The issue is particularly critical for applications that rely on method-level security for sensitive operations.
How To Fix
Latest published version: 7.2.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.4.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using @EnableMethodSecurity(mode=ASPECTJ) for private methods that require security annotations. Instead, consider refactoring these methods to be package-private or public, or implement alternative security measures until the package can be updated.
Conclusion
In summary, CVE-2025-41232 represents a critical vulnerability in the Spring Security framework that can lead to unauthorized access to private methods. It is essential to update the 'spring-security-aspects' package to version 6.4.6 or later to mitigate this risk. Additionally, consider using Vulert to monitor your application for vulnerabilities.
See every vulnerability recorded for org.springframework.security:spring-security-aspects →
FAQ
CVE-2025-41232 is a vulnerability in Spring Security that allows unauthorized access to private methods due to improper handling of method security annotations.
If your application uses @EnableMethodSecurity(mode=ASPECTJ) and has Spring Security annotations on private methods, it may be vulnerable to unauthorized access.
Consider refactoring private methods to be package-private or public, or implement alternative security measures as a temporary workaround.
You can use Vulert's playground at Vulert Scanner to monitor and alert for open-source vulnerabilities in your software without requiring access to the code.
The CVSS score for this vulnerability is 9.1, indicating a critical level of severity.
