Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.springframework.security:spring-security-core

31 known vulnerabilities (2 critical, 3 high, 6 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
31 · 2 critical, 3 high, 6 medium, 3 low
Registry
Maven Central

Advisories 31

  • User Attribute Enumeration when Using DaoAuthenticationProvider

    Affected: from 5.7.0, through 5.7.22; from 5.8.0, through 5.8.24; from 6.3.0, through 6.3.15; from 6.4.0, through 6.4.15; from 6.5.0, fixed in 6.5.10; from 7.0.0, fixed in 7.0.5.

  • CVE-2026-22751Medium 4.8

    Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions

    Affected: from 6.5.0, fixed in 6.5.10; from 7.0.3, fixed in 7.0.5; from 6.4.0, through 6.4.13.

  • CVE-2025-22234Medium 5.3

    Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation

    Affected: from 6.3.8, fixed in 6.3.9; from 6.4.4, fixed in 6.4.5.

  • CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types

    Affected: from 6.4.0, fixed in 6.4.10; from 6.5.0, fixed in 6.5.4.

  • CVE-2025-41232Critical 9.1

    CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods

    Affected: from 6.4.0, fixed in 6.4.6.

  • CVE-2025-22223Medium 5.3

    Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods.

    Affected: from 6.4.0, fixed in 6.4.4.

  • CVE-2024-38827Medium 4.8

    Spring Security Authorization Bypass for Case Sensitive Comparisons

    Affected: fixed in 5.7.14; from 5.8.0, fixed in 5.8.16; from 6.0.0, fixed in 6.0.14; from 6.1.0, fixed in 6.1.12; from 6.2.0, fixed in 6.2.8; from 6.3.0, fixed in 6.3.5.

  • CVE-2024-38810Medium 6.5

    Missing Authorization When Using @AuthorizeReturnObject

    Affected: from 6.3.0, fixed in 6.3.2.

  • In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8…

    Affected: fixed in 5.7.12; from 5.8.0, fixed in 5.8.11; from 6.0.0, fixed in 6.1.8; from 6.2.0, fixed in 6.2.3.

  • CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated

    Affected: from 6.1.0, fixed in 6.1.7; from 6.2.0, fixed in 6.2.2.

  • CVE-2023-20862Medium 6.3

    In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support…

    Affected: from 5.7.0, fixed in 5.7.8; from 5.8.0, fixed in 5.8.3; from 6.0.0, fixed in 6.0.3.

  • CVE-2022-31692Critical 9.8

    Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or…

    Affected: from 5.7.0, fixed in 5.7.5; from 5.6.0, fixed in 5.6.9.

  • Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow…

    Affected: from 5.2.0.RELEASE, fixed in 5.5.7; from 5.6.0, fixed in 5.6.4.

  • In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be…

    Affected: from 5.5.0, fixed in 5.5.7; from 5.6.0, fixed in 5.6.4; fixed in 5.4.11.

  • Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a…

    Affected: from 5.5.0, fixed in 5.5.1; from 5.4.0, fixed in 5.4.7; from 5.3.0, fixed in 5.3.10; from 5.2.0, fixed in 5.2.11.

Show all 31 advisoriesShow fewer advisories

  • Dictionary attack with Spring Security queryable text encryptor

    Affected: from 5.3.0, fixed in 5.3.2; from 5.2.0, fixed in 5.2.4; from 5.1.0, fixed in 5.1.10; from 5.0.0, fixed in 5.0.16; fixed in 4.2.16.

  • Signature Wrapping Vulnerability with spring-security-saml2-service-provider

    Affected: from 5.2.0, fixed in 5.2.4; from 5.3.0, fixed in 5.3.2.

  • PlaintextPasswordEncoder authenticates encoded passwords that are null

    Affected: fixed in 4.2.13.

  • Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security

    Affected: from 4.2.0, fixed in 4.2.12; from 5.0.0, fixed in 5.0.12; from 5.1.0, fixed in 5.1.5.

  • Authorization Bypass During JWT Issuer Validation with spring-security

    Affected: from 5.1.0, fixed in 5.1.2.

  • Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14…

    Affected: from 4.2.0, fixed in 4.2.4; from 5.0.0, fixed in 5.0.1; from 4.1.0, fixed in 4.1.5.

  • An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1.

    Affected: from 4.2.0.RELEASE, fixed in 4.2.3.RELEASE; from 5.0.0.M1, fixed in 5.0.0.M2.

  • Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for…

    Affected: fixed in 4.1.1.

  • When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service…

    Affected: fixed in 3.1.7; from 3.2.0, fixed in 3.2.5.

  • The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length.

    Affected: from 3.2.0, fixed in 3.2.2.RELEASE; from 3.1.0, fixed in 3.1.5.RELEASE.

  • An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1.

    Affected: fixed in 3.2.10.RELEASE; from 4.0.0.RELEASE, fixed in 4.1.4.RELEASE; from 4.2.0.RELEASE, fixed in 4.2.1.RELEASE.

  • DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check…

    Affected: fixed in 2.0.8; from 3.0.0, fixed in 3.0.8; from 3.1.0, fixed in 3.1.3.

  • CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows…

    Affected: fixed in 2.0.7; from 3.0.0, fixed in 3.0.6.

  • Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the…

    Affected: fixed in 2.0.7; from 3.0.0, fixed in 3.0.6.

  • Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize…

    Affected: from 3.0.0, fixed in 3.0.6; from 2.0.0, fixed in 2.0.7.

  • VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM…

    Affected: from 2.0.0, fixed in 2.0.6; from 3.0.0, fixed in 3.0.4.