CVE-2025-22223CWE-290

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods

Medium · published March 24, 2025

CVSS v3.1
5.3
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass.

You are not affected if you are not using @EnableMethodSecurity, or

you do not have method security annotations on parameterized types or methods, or all method security annotations are attached to target methods

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00506 · 42.3th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2025-03-24T17:42Z
EPSS history
Timeline
  • 24 MAR 17:42Z
    Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods
    cvelistv5