CVE-2026-22746 User Attribute Enumeration when Using DaoAuthenticationProvider

🗓️ 22 Apr 2026 05:02:24Reported by vmwareType

CVE-2026-22746 bypasses DaoAuthenticationProvider timing defense when using user status attributes.

Reporter	Title	Published	Views	Family All 41
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Observable Timing Discrepancy (CVE-2026-22746)	15 Jun 202620:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	24 May 202615:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	28 May 202613:24	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of spring-security-core-6.5.9.jar, IBM Sterling Connect:Direct Web Services is vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition	6 Jun 202613:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for May 2026	12 Jun 202622:52	–	ibm
ATTACKERKB	CVE-2026-22746	22 Apr 202605:02	–	attackerkb
Chainguard	CVE-2026-22746 vulnerabilities	30 Apr 202619:17	–	cgr
Circl	CVE-2026-22746	22 Apr 202608:43	–	circl
CNNVD	Spring Security 安全漏洞	22 Apr 202600:00	–	cnnvd
CVE	CVE-2026-22746	22 Apr 202605:02	–	cve

[
  {
    "vendor": "Spring",
    "product": "Spring Security",
    "versions": [
      {
        "status": "affected",
        "version": "5.7.0",
        "lessThanOrEqual": "5.7.22",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.8.0",
        "lessThanOrEqual": "5.8.24",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.3.0",
        "lessThanOrEqual": "6.3.15",
        "versionType": "custom"
      },
      {
        "status": "unknown",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.15",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.5.0",
        "lessThanOrEqual": "6.5.9",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.4",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
spring	www.spring.io/security/cve-2026-22746

22 Apr 2026 05:02Current

CVSS 3.13.7

EPSS0.00215