Spring Security Vulnerable to Authorization Bypass via Security Annotations

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or...

CVE-2025-22223

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or...

CVE-2025-22223

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or...

CVE-2025-22223

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or...

CVE-2025-22223

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or...

CVE-2025-22223

Spring Security 6.4.0–6.4.3 may fail to locate method security annotations on parameterized types or methods, potentially bypassing authorization. IBM/WatsonX data shows affected product watsonx.data (2.1.3) with remediation to upgrade to watsonx.data 2.2 or CPD 5.2; IBM Maximo AI Broker also lis...

VMware Spring Security 安全漏洞

VMware Spring Security is a set of security frameworks from VMware, Inc. that provide illustrative security protection for Spring-based applications. A security vulnerability exists in VMware Spring Security versions 6.4.0 through 6.4.3 that originates from an authorization bypass...

CVE-2025-22223: Authentication Bypass by Spoofing

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or...

CicadasCMS 注入漏洞

CicadasCMS is a content management framework developed based on SpringBoot Mybatis SpringSecurity Vue by westboy Individual Developer in China. An injection vulnerability exists in CicadasCMS version 1.0, which stems from vulnerability to SQL injection attacks...

com.ahome-it:ahome-tooling-server-core (>=1.1.19-release, <=1.1.27-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.23-release, <=1.1.27-release) +4 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.0.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.ahome-it:ahome-tooling-server-core...

com.marcosbarbero.cloud:spring-cloud-zuul-ratelimit-core (>=1.7.3.release, <=1.7.4.release), net.acesinc:convergent-ui (1.1.2) +32 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.11.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: -...

ai.driftkit:driftkit-chat-assistant-framework (>=0.5.0, <=0.9.2), ai.driftkit:driftkit-clients-spring-ai-starter (>=0.6.0, <=0.9.2) +3025 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.3.0, <=6.3.7)

org.springframework.security:spring-security-crypto MAVEN version =6.3.0, =0.5.0, =0.6.0, =0.5.0, =0.8.4, =0.8.4, =0.9.1, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.9.2 and more Source cves: CVE-2025-22228 Source advisory:...

com.github.ptomli.bedrock:bedrock-core (1.0.0), com.mnubo:sdk-android (>=1.0.1, <=1.3.0) +9 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (3.1.3.release)

org.springframework.security:spring-security-crypto MAVEN version 3.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.github.ptomli.bedrock:bedrock-core 1.0.0 -...

com.apigee.edge.config:apigee-config-maven-plugin (>=1.2, <=1.2.2), com.apigee.smartdocs.config:apigee-smartdocs-maven-plugin (>=1.0.0, <=1.0.3) +38 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (3.2.9.release)

org.springframework.security:spring-security-crypto MAVEN version 3.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.apigee.edge.config:apigee-config-maven-plugin...

com.miserablemind:tradeking-api-consumer (1.0.0-alpha), de.codecentric:spring-boot-admin-sample-discovery (1.2.0) +19 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (3.2.6.release)

org.springframework.security:spring-security-crypto MAVEN version 3.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.miserablemind:tradeking-api-consumer...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +3211 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.2.0, <=6.2.8)

org.springframework.security:spring-security-crypto MAVEN version =6.2.0, =0.2.0, =0.0.1, =0.5.2, =0.5.0, =7.0.0, =1.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.31 and more Source cves: CVE-2025-22228 Source advisory: OSV:GHSA-MG83-C7GQ-RV5C...

br.jus.stf.digital:core (>=2.0.0, <=2.3.1), br.jus.stf.digital:test (>=1.0.3, <=1.1.0) +502 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.2.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - br.jus.stf.digital:core =2.0.0, =1.0.3, =1.1.7,...

com.alibaba.cloud:spring-cloud-alibaba-nacos-config (1.5.0.release), com.alibaba.cloud:spring-cloud-alibaba-nacos-discovery (1.5.0.release) +145 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.8.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.alibaba.cloud:spring-cloud-alibaba-nacos-conf...

com.actionsky:txle-server (>=2.19.10.0, <=2.19.11.0), com.arcadeanalytics:arcadeanalytics (>=1.0.2, <=1.0.8) +172 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.7.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.actionsky:txle-server =2.19.10.0, =1.0.2,...

cn.springcloud.gray:spring-cloud-bamboo (>=1.0.0, <=1.0.2), cn.springcloud.gray:spring-cloud-gray-client (>=a.1.0.1, <=1.0.2) +870 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.3.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - cn.springcloud.gray:spring-cloud-bamboo =1.0.0,...