CVE-2025-22223: Spring Security Core Authorization Bypass Vulnerability
Summary
CVE-2025-22223: Spring Security Vulnerable to Authorization Bypass via Security Annotations. Affects org.springframework.security:spring-security-core versions >= 6.4.0, < 6.4.4. Fixed in 6.4.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Security is a powerful and customizable authentication and access-control framework for Java applications. It provides comprehensive security services for Java EE-based enterprise software applications. The framework is widely used to secure applications by managing user authentication and authorization. However, versions 6.4.0 to 6.4.3 of Spring Security contain a vulnerability that may allow unauthorized access due to improper handling of method security annotations on parameterized types or methods.
Vulnerability Detail
The vulnerability in Spring Security versions 6.4.0 to 6.4.3 arises from the framework's failure to correctly locate method security annotations on parameterized types or methods. This oversight can lead to an authorization bypass, allowing users to access methods without the necessary permissions. The issue is particularly concerning for applications that utilize the @EnableMethodSecurity annotation and have method security annotations on parameterized types or methods. If these conditions are met, unauthorized users may gain access to sensitive functionality, potentially compromising application security.
How To Fix
Latest published version: 7.2.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.4.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately upgrade to the patched version, consider the following workaround:
- Avoid using @EnableMethodSecurity if possible.
- Ensure that all method security annotations are attached directly to the target methods rather than parameterized types or methods. This may help mitigate the risk of authorization bypass until an upgrade can be performed.
Conclusion
In summary, the Spring Security vulnerability identified as CVE-2025-22223 poses a risk of authorization bypass in versions 6.4.0 to 6.4.3. It is crucial for developers to update to version 6.4.4 or later to mitigate this risk. Additionally, understanding the nature of the vulnerability and implementing the suggested workarounds can help maintain application security until an upgrade is feasible.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
Spring Security versions 6.4.0 to 6.4.3 are affected by this vulnerability.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate upgrade is not possible, consider avoiding the use of @EnableMethodSecurity and ensure that method security annotations are applied directly to target methods.
The potential consequences include unauthorized access to sensitive methods and functionalities, which can compromise the security of your application.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
