CVE-2026-22746: Spring Security User Attribute Enumeration Vulnerability
Summary
CVE-2026-22746: Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider. Affects org.springframework.security:spring-security-core across 6 version ranges.
>= 5.7.0, <= 5.7.22
>= 5.8.0, <= 5.8.24
>= 6.3.0, <= 6.3.15
>= 6.4.0, <= 6.4.15
>= 6.5.0, < 6.5.10
>= 7.0.0, < 7.0.5
Fixed in 6.5.10 or 7.0.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Security is a powerful and customizable authentication and access control framework for Java applications. It provides comprehensive security services for Java EE-based enterprise software applications. The framework is widely used to secure applications by managing user authentication and authorization. However, certain configurations can expose applications to vulnerabilities, such as user attribute enumeration, which can lead to unauthorized access or information disclosure.
Vulnerability Detail
The vulnerability arises from the improper handling of user attributes related to account status, specifically when using DaoAuthenticationProvider. If an application relies on the UserDetails interface methods like isEnabled, isAccountNonExpired, or isAccountNonLocked to manage user access, attackers can exploit timing attacks to determine the status of user accounts. This can lead to unauthorized enumeration of user accounts that are disabled, expired, or locked, potentially allowing attackers to target specific accounts for further exploitation.
How To Fix
Latest published version: 7.2.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.5.0, < 6.5.106.5.10 -
>= 7.0.0, < 7.0.57.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider disabling the use of the UserDetails methods that expose account status attributes until you can apply the patch. This may involve customizing your authentication logic to avoid revealing account status information.
Conclusion
CVE-2026-22746 is a significant vulnerability in Spring Security that can lead to user attribute enumeration. It is crucial for developers to update to the patched versions of the library to mitigate this risk. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
CVE-2026-22746 is a vulnerability in Spring Security that allows attackers to enumerate user attributes related to account status, potentially leading to unauthorized access.
The affected versions are from 5.7.0 to 5.7.22, 5.8.0 to 5.8.24, 6.3.0 to 6.3.15, 6.5.0 to 6.5.9, and 7.0.0 to 7.0.4.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application's pom.xml against this vulnerability using the Vulert playground at Vulert Scanner without needing to sign up.
The CVSS score for this vulnerability is 3.7, indicating a low severity level.
If immediate updates are not possible, implement the suggested workaround by disabling the use of UserDetails methods that expose account status attributes.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
