CVE-2025-41232

🗓️ 21 May 2025 10:23:07Reported by vmwareType

Spring Security may allow authorization bypass on private methods with specific annotations configured.

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: Maximo AI Service Component: Spring Security Aspects may not correctly locate method security annotations on private methods.	5 Jun 202507:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in spring-security-core-6.4.5.jar	29 Aug 202506:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.1.0	5 Dec 202509:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for December 2025.	12 Jan 202617:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by a vulnerability in spring-security-core-6.4.5.jar (CVE-2025-41232)	24 Oct 202506:51	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring Security, Handlebars, Apache MINA and Apache Tomcat might affect IBM Storage Defender Copy Data Management	26 Jun 202617:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services vulnerable to spring-security-core-6.4.3.jar (CVE-2025-41232)	27 Jun 202506:26	–	ibm
ATTACKERKB	CVE-2025-41232	21 May 202512:16	–	attackerkb
BDU FSTEC	The vulnerability of the configuration @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects in the Java framework for securing Spring-based industrial applications allows attackers to bypass the authentication process.	26 May 202500:00	–	bdu_fstec
Circl	CVE-2025-41232	21 May 202512:26	–	circl

[
  {
    "defaultStatus": "unaffected",
    "packageName": "Spring Security",
    "product": "Spring Security",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "6.4.6",
        "status": "affected",
        "version": "6.4.x",
        "versionType": "oss"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2025-41232

17 Jun 2026 09:22Current

8.3High risk

Vulners AI Score8.3

CVSS 3.19.1

EPSS0.00516

SSVC

CWE-693