# org.springframework.security:spring-security-core (Maven) vulnerabilities 31 known vulnerabilities (2 critical, 3 high, 6 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://central.sonatype.com/artifact/org.springframework.security/spring-security-core ## Advisories (31) ### [CVE-2026-22746](https://cve.now/CVE-2026-22746): User Attribute Enumeration when Using DaoAuthenticationProvider - Severity: Low 3.7 - Published: Apr 22, 2026 - Affected: from 5.7.0, through 5.7.22; from 5.8.0, through 5.8.24; from 6.3.0, through 6.3.15; from 6.4.0, through 6.4.15; from 6.5.0, fixed in 6.5.10; from 7.0.0, fixed in 7.0.5. ### [CVE-2026-22751](https://cve.now/CVE-2026-22751): Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions - Severity: Medium 4.8 - Published: Apr 21, 2026 - Affected: from 6.5.0, fixed in 6.5.10; from 7.0.3, fixed in 7.0.5; from 6.4.0, through 6.4.13. ### [CVE-2025-22234](https://cve.now/CVE-2025-22234): Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation - Severity: Medium 5.3 - Published: Jan 22, 2026 - Affected: from 6.3.8, fixed in 6.3.9; from 6.4.4, fixed in 6.4.5. ### [CVE-2025-41248](https://cve.now/CVE-2025-41248): CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types - Severity: High 7.5 - Published: Sep 16, 2025 - Affected: from 6.4.0, fixed in 6.4.10; from 6.5.0, fixed in 6.5.4. ### [CVE-2025-41232](https://cve.now/CVE-2025-41232): CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods - Severity: Critical 9.1 - Published: May 21, 2025 - Affected: from 6.4.0, fixed in 6.4.6. ### [CVE-2025-22223](https://cve.now/CVE-2025-22223): Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. - Severity: Medium 5.3 - Published: Mar 24, 2025 - Affected: from 6.4.0, fixed in 6.4.4. ### [CVE-2024-38827](https://cve.now/CVE-2024-38827): Spring Security Authorization Bypass for Case Sensitive Comparisons - Severity: Medium 4.8 - Published: Dec 2, 2024 - Affected: fixed in 5.7.14; from 5.8.0, fixed in 5.8.16; from 6.0.0, fixed in 6.0.14; from 6.1.0, fixed in 6.1.12; from 6.2.0, fixed in 6.2.8; from 6.3.0, fixed in 6.3.5. ### [CVE-2024-38810](https://cve.now/CVE-2024-38810): Missing Authorization When Using @AuthorizeReturnObject - Severity: Medium 6.5 - Published: Aug 20, 2024 - Affected: from 6.3.0, fixed in 6.3.2. ### [CVE-2024-22257](https://cve.now/CVE-2024-22257): In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8… - Severity: High 8.2 - Published: Mar 18, 2024 - Affected: fixed in 5.7.12; from 5.8.0, fixed in 5.8.11; from 6.0.0, fixed in 6.1.8; from 6.2.0, fixed in 6.2.3. ### [CVE-2024-22234](https://cve.now/CVE-2024-22234): CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated - Severity: High 7.4 - Published: Feb 20, 2024 - Affected: from 6.1.0, fixed in 6.1.7; from 6.2.0, fixed in 6.2.2. ### [CVE-2023-20862](https://cve.now/CVE-2023-20862): In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support… - Severity: Medium 6.3 - Published: Apr 19, 2023 - Affected: from 5.7.0, fixed in 5.7.8; from 5.8.0, fixed in 5.8.3; from 6.0.0, fixed in 6.0.3. ### [CVE-2022-31692](https://cve.now/CVE-2022-31692): Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or… - Severity: Critical 9.8 - Published: Oct 31, 2022 - Affected: from 5.7.0, fixed in 5.7.5; from 5.6.0, fixed in 5.6.9. ### [CVE-2022-22976](https://cve.now/CVE-2022-22976): Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow… - Severity: Unrated - Published: May 19, 2022 - Affected: from 5.2.0.RELEASE, fixed in 5.5.7; from 5.6.0, fixed in 5.6.4. ### [CVE-2022-22978](https://cve.now/CVE-2022-22978): In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be… - Severity: Unrated - Published: May 19, 2022 - Affected: from 5.5.0, fixed in 5.5.7; from 5.6.0, fixed in 5.6.4; fixed in 5.4.11. ### [CVE-2021-22119](https://cve.now/CVE-2021-22119): Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a… - Severity: Unrated - Published: Jun 29, 2021 - Affected: from 5.5.0, fixed in 5.5.1; from 5.4.0, fixed in 5.4.7; from 5.3.0, fixed in 5.3.10; from 5.2.0, fixed in 5.2.11. ### [CVE-2020-5408](https://cve.now/CVE-2020-5408): Dictionary attack with Spring Security queryable text encryptor - Severity: Unrated - Published: May 14, 2020 - Affected: from 5.3.0, fixed in 5.3.2; from 5.2.0, fixed in 5.2.4; from 5.1.0, fixed in 5.1.10; from 5.0.0, fixed in 5.0.16; fixed in 4.2.16. ### [CVE-2020-5407](https://cve.now/CVE-2020-5407): Signature Wrapping Vulnerability with spring-security-saml2-service-provider - Severity: Unrated - Published: May 13, 2020 - Affected: from 5.2.0, fixed in 5.2.4; from 5.3.0, fixed in 5.3.2. ### [CVE-2019-11272](https://cve.now/CVE-2019-11272): PlaintextPasswordEncoder authenticates encoded passwords that are null - Severity: Unrated - Published: Jun 26, 2019 - Affected: fixed in 4.2.13. ### [CVE-2019-3795](https://cve.now/CVE-2019-3795): Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security - Severity: Low 3.8 - Published: Apr 9, 2019 - Affected: from 4.2.0, fixed in 4.2.12; from 5.0.0, fixed in 5.0.12; from 5.1.0, fixed in 5.1.5. ### [CVE-2018-15801](https://cve.now/CVE-2018-15801): Authorization Bypass During JWT Issuer Validation with spring-security - Severity: Low 3.3 - Published: Dec 19, 2018 - Affected: from 5.1.0, fixed in 5.1.2. ### [CVE-2018-1199](https://cve.now/CVE-2018-1199): Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14… - Severity: Unrated - Published: Mar 16, 2018 - Affected: from 4.2.0, fixed in 4.2.4; from 5.0.0, fixed in 5.0.1; from 4.1.0, fixed in 4.1.5. ### [CVE-2017-4995](https://cve.now/CVE-2017-4995): An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. - Severity: Unrated - Published: Nov 27, 2017 - Affected: from 4.2.0.RELEASE, fixed in 4.2.3.RELEASE; from 5.0.0.M1, fixed in 5.0.0.M2. ### [CVE-2016-5007](https://cve.now/CVE-2016-5007): Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for… - Severity: Unrated - Published: May 25, 2017 - Affected: fixed in 4.1.1. ### [CVE-2014-3527](https://cve.now/CVE-2014-3527): When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service… - Severity: Unrated - Published: May 25, 2017 - Affected: fixed in 3.1.7; from 3.2.0, fixed in 3.2.5. ### [CVE-2014-0097](https://cve.now/CVE-2014-0097): The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. - Severity: Unrated - Published: May 25, 2017 - Affected: from 3.2.0, fixed in 3.2.2.RELEASE; from 3.1.0, fixed in 3.1.5.RELEASE. ### [CVE-2016-9879](https://cve.now/CVE-2016-9879): An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. - Severity: Unrated - Published: Jan 6, 2017 - Affected: fixed in 3.2.10.RELEASE; from 4.0.0.RELEASE, fixed in 4.1.4.RELEASE; from 4.2.0.RELEASE, fixed in 4.2.1.RELEASE. ### [CVE-2012-5055](https://cve.now/CVE-2012-5055): DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check… - Severity: Unrated - Published: Dec 5, 2012 - Affected: fixed in 2.0.8; from 3.0.0, fixed in 3.0.8; from 3.1.0, fixed in 3.1.3. ### [CVE-2011-2732](https://cve.now/CVE-2011-2732): CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows… - Severity: Unrated - Published: Dec 5, 2012 - Affected: fixed in 2.0.7; from 3.0.0, fixed in 3.0.6. ### [CVE-2011-2731](https://cve.now/CVE-2011-2731): Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the… - Severity: Unrated - Published: Dec 5, 2012 - Affected: fixed in 2.0.7; from 3.0.0, fixed in 3.0.6. ### [CVE-2011-2894](https://cve.now/CVE-2011-2894): Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize… - Severity: Unrated - Published: Oct 4, 2011 - Affected: from 3.0.0, fixed in 3.0.6; from 2.0.0, fixed in 2.0.7. ### [CVE-2010-3700](https://cve.now/CVE-2010-3700): VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM… - Severity: Unrated - Published: Oct 29, 2010 - Affected: from 2.0.0, fixed in 2.0.6; from 3.0.0, fixed in 3.0.4. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.springframework.security:spring-security-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.