CVE-2026-22746

🗓️ 22 Apr 2026 05:02:24Reported by vmwareType

Spring Security: DaoAuthenticationProvider timing defense bypass for disabled, expired, or locked users.

Reporter	Title	Published	Views	Family All 161
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	12 Aug 202611:52	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Observable Timing Discrepancy (CVE-2026-22746)	15 Jun 202620:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	24 May 202615:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	28 May 202613:24	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	14 Jul 202623:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilties in DevOps Test Hub	22 Oct 202607:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Spring Boot's Cassandra have been addressed in IBM webMethods API Management	28 Aug 202604:56	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of spring-security-core-6.5.9.jar, IBM Sterling Connect:Direct Web Services is vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition	6 Jun 202613:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for May 2026	12 Jun 202622:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in Spring Security affect IBM Sterling B2B Integrator and IBM Sterling File Gateway	15 Sep 202613:32	–	ibm

NVD

Vulners

Node

vmware spring_securityRange<5.7.23

vmware spring_securityRange5.8.0–5.8.25

vmware spring_securityRange6.3.0–6.3.16

vmware spring_securityRange6.4.0–6.4.16

vmware spring_securityRange6.5.0–6.5.10

vmware spring_securityRange7.0.0–7.0.5

[
  {
    "vendor": "Spring",
    "product": "Spring Security",
    "versions": [
      {
        "status": "affected",
        "version": "5.7.0",
        "lessThanOrEqual": "5.7.22",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.8.0",
        "lessThanOrEqual": "5.8.24",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.3.0",
        "lessThanOrEqual": "6.3.15",
        "versionType": "custom"
      },
      {
        "status": "unknown",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.15",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.5.0",
        "lessThanOrEqual": "6.5.9",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.4",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
spring	www.spring.io/security/cve-2026-22746

17 Jun 2026 10:20Current

7.2High risk

Vulners AI Score7.2

CVSS 3.13.7

EPSS0.00215

SSVC

CWE-208