EUVD-2026-24607

Vulnerability in Spring Spring Security. If an application is using the UserDetailsisEnabled, isAccountNonExpired, or isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, o...

PT-2026-34250

Name of the Vulnerable Software and Affected Versions Spring Security versions 5.7.0 through 5.7.22 Spring Security versions 5.8.0 through 5.8.24 Spring Security versions 6.3.0 through 6.3.15 Spring Security versions 6.5.0 through 6.5.9 Spring Security versions 7.0.0 through 7.0.4 Description An...