cve-2026-22732-poc

CVE-2026-22732 — Proof of Concept Spring Security silently drops HTTP response security headers. Demo / educational use only; run it against nothing but this local app. | ---|--- CVE| CVE-2026-22732 CWE-425, published 2026-03-19 CVSS 3.1| 9.1 CRITICAL — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Direct...

rewrite-cve-2026-22732

rewrite-cve-2026-22732 OpenRewrite recipe that detects code susceptible to CVE-2026-22732, a Spring Security defect where setting Content-Length through one of three response methods bypasses Spring Security's OnCommittedResponseWrapper. Because the wrapper never sees the header,...

CVE-2022-22978

CVE-2022-22978 Spring Security Pass Spring Security 成功 http://localhost:9090/login%0a Pass Spring Security with SayMyName 失敗 http://localhost:9090/name%0d Bypass Spring Security with Custom RBAC 失敗 http://localhost:9090/admin/admin%0d Bypass Spring Security with Annotation RBAC 失敗...

xbootEncodePwd

xbootEncodePwd xboot-activiti-1.0-SNAPSHOT xboot-cms-1.0-SNAPSHOT xboot-generator-1.0-SNAPSHOT xboot-app-1.0-SNAPSHOT xboot-core-1.0-SNAPSHOT xboot-open-1.0-SNAPSHOT xboot-autochat-1.0-SNAPSHOT xboot-docking-1.0-SNAPSHOT xboot-quartz-1.0-SNAPSHOT xboot-base-1.0-SNAPSHOT xboot-ems-1.0-SNAPSHOT...

cve-2022-31692

CVE-2022-31692 Demo Overview A simple Spring Boot application demonstrating configuration that is vulnerable to CVE-2022-31692. This vulnerability may attract attention due to its severity - it has a CVSS 3.x base score of 9.8 as it allows authentication bypass. The purpose of this project is to...

CVE-2022-22978-PoC

CVE 2022-22978: Authorization Bypass in RegexRequestMatcher 🥶 Overview According to the information I have gathered, this vulnerability is related to the RegexRequestMatcher class in the Spring Security framework. Specifically, applications using RegexRequestMatcher where the regular expression...

CVE-2022-22978

CVE-2022-22978 Spring-Security bypass Demo When using RegexRequestMatcher in Spring Security and the regex rule contains a dot ., an attacker can bypass authentication by crafting a malicious packet. Affected Range Spring Security 5.5.x Spring Security 5.6.x http://localhost:8080/admin/index%0a...

CVE-2026-111235

An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/ Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no...

CVE-2026-111235 OpenNMS REST authorization bypass via non-canonical HTTP method

An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/ Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no...

GSSC-CVE-2022-41923

Workaround for CVE-2022-41923: Privilege Management Vulnerability Summary The vulnerability CVE-2022-41923 found in the unpatched Grails Spring Security Core GSSC plugin can result in improper privilege management. This repository describes how to work around the issue. If you are using an...

ROOT-APP-MAVEN-CVE-2024-38821 CVE-2024-38821 in org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2024-38821 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22732 CVE-2026-22732 in org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2026-22732 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

Spring-CVE-2022-22947-

This repository does not have a README...

cve-2023-34034

cve-2023-34034 Demonstration of CVE-2023-34034 authorization bypass in Spring Security. See CVE-2023-34034 Spring Security Authorization Bypass on Don't Panic!...

CVE-2022-22978

CVE 2022-22978: Authorization Bypass in RegexRequestMatcher 🥶 Overview According to the information I have gathered, this vulnerability relates to the RegexRequestMatcher class in the Spring Security framework. Specifically, applications using RegexRequestMatcher where the regular expression...

cve-2023-34035-mitigations

This repo is a set of samples to demonstrate the arrangements wherein applications may be vulnerable to https://spring.io/security/cve-2023-34035CVE-2023-34035. An application is vulnerable when all of the following are true: Spring MVC is on the classpath DispatcherServlet and at least one other...

CVE-2019-3778-Spring-Security-OAuth-2.3-Open-Redirection

CVE-2019-3778-Spring-Security-OAuth-2.3-Open-Redirection Spring Security OAuth 2.3 Open Redirection 分析复现篇 Exploit Title: Open Redirector in spring-security-oauth2 Date: 17 June 2019 Exploit Author: Riemann Vendor Homepage: https://spring.io/projects/spring-security-oauth Software Link:...

cve-2025-22235-demo

CVE-2025-22235: Spring Boot EndpointRequest.to Authentication Bypass Vulnerability Demo Vulnerability Description CVE-2025-22235 is a Spring Boot security vulnerability involving the EndpointRequest.to method, which may generate an incorrect matcher when configuring security rules, leading to the...

CVE-2024-38821-POC

CVE-2024-38821: Proof of Concept PoC: Authentication Bypass in Spring Framework This is a proof of concept for the CVE-2024-38821 vulnerability Execution Steps 1. Build the Docker image Spring Boot 3.3.4, based on Spring Framework 6.1.13 cd vuln docker build -t cve-2024-38821-poc . 2. Run the...

CVE-2022-22978-demo

CVE-2022-22978-demo CVE-2022-22978 vulnerability demo code Exploitation Conditions Although rated as high severity, the exploitation conditions are quite stringent. Personally, I find this vulnerability rather underwhelming. 1. First, spring-security must be within the affected scope. 2. Second, ...