Spring Security authorization bypass for method security annotations on private methods

🗓️ 21 May 2025 15:30:33Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 13 Views

Spring Security may bypass authorization for method security annotations on private methods.

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: Maximo AI Service Component: Spring Security Aspects may not correctly locate method security annotations on private methods.	5 Jun 202507:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in spring-security-core-6.4.5.jar	29 Aug 202506:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.1.0	5 Dec 202509:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for December 2025.	12 Jan 202617:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by a vulnerability in spring-security-core-6.4.5.jar (CVE-2025-41232)	24 Oct 202506:51	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring Security, Handlebars, Apache MINA and Apache Tomcat might affect IBM Storage Defender Copy Data Management	26 Jun 202617:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services vulnerable to spring-security-core-6.4.3.jar (CVE-2025-41232)	27 Jun 202506:26	–	ibm
ATTACKERKB	CVE-2025-41232	21 May 202512:16	–	attackerkb
BDU FSTEC	The vulnerability of the configuration @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects in the Java framework for securing Spring-based industrial applications allows attackers to bypass the authentication process.	26 May 202500:00	–	bdu_fstec
Circl	CVE-2025-41232	21 May 202512:26	–	circl

Vulners

Node

org.springframework.security spring-security-coreRange6.4.0–6.4.6maven

OR

org.springframework.security spring-security-aspectsRange6.4.0–6.4.6maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-41232
spring	www.spring.io/security/cve-2025-41232
github	www.github.com/spring-projects/spring-security/commit/bf2aaa1b1830e534ba651d422545ac08a115151b
github	www.github.com/spring-projects/spring-security/commit/c972de5369a1261ab674a3f5e3a80e8ce3e8cdfb
github	www.github.com/spring-projects/spring-security/releases/tag/6.4.6
github	www.github.com/advisories/GHSA-9pp5-9c7g-4r83

15 Oct 2025 20:13Current

7High risk

Vulners AI Score7

CVSS 3.19.1

EPSS0.00516

SSVC

spring security authorization bypass private methods method security annotations software vulnerabilities