CVE-2026-22746
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In Spring Security, if an application uses the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes to enable, expire, or lock users, DaoAuthenticationProvider's timing attack defense can be bypassed for disabled, expired, or locked users. This affects Spring Security 5.7.0 through 5.7.22, 5.8.0 through 5.8.24, 6.3.0 through 6.3.15, 6.5.0 through 6.5.9, and 7.0.0 through 7.0.4.
Risk Assessment
An attacker can distinguish account states (disabled, expired, locked) based on timing differences, facilitating account enumeration and planning further attacks. The risk affects applications using the listed user attributes.
Recommendation
Update Spring Security to a version outside the listed vulnerable ranges. Until updated, monitor for unusual login patterns.
Other vulnerabilities in Spring Security
See all- CVE-2014-0097High
The ActiveDirectoryLdapAuthenticator in Spring Security versions 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds, it may incorrectly authenticate a user who supplies an empty password.
- CVE-2026-59270Critical
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Affected versions include Spring Security 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, 6.4.0-6.4.18, 5.8.0-5.8.27, and 5.7.0-5.7.25.
- CVE-2026-59277Low
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as internal (private) or external (public). Affects Spring Security 7.1.0.
- CVE-2026-59276Medium
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.
- CVE-2026-47877High
Spring Security Authorization Server versions 7.1.0 and 7.0.0-7.0.6 are vulnerable because the default consent page renders user-controlled values without HTML entity encoding.
- CVE-2026-47842Medium
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Affected versions include Spring Security 5.7.0 through 7.1.0.
- CVE-2026-47841High
An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Affected versions: Spring Security 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, 6.4.0-6.4.18.
- CVE-2026-41707High
Authentication Bypass by Capture-replay vulnerability in Spring Security allows Spring Security's DPoPProofJwtDecoderFactory to contain a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.
- CVE-2026-47838Medium
The SubjectDnX509PrincipalExtractor in Spring Security does not correctly handle certain malformed X.509 certificate CN values, potentially reading the wrong username. A crafted certificate could allow an attacker to impersonate another user. Affected versions: 5.7.0-5.7.24, 5.8.0-5.8.26, 6.3.0-6.3.17, 6.4.0-6.4.17, 6.5.0-6.5.10.
- CVE-2026-41706Medium
A vulnerability in Spring Security's CookieRequestCache and CookieServerRequestCache stores the full absolute pre-authentication URL in a browser cookie. After login, the user is redirected to this URL without validation, enabling an open redirect attack.
Original NVD description (English source)
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS