📄 Vaadin 25.x Authentication Bypass

An authentication bypass affects Vaadin versions 6.8.13, 14.x, 23.x, 24.x, and 25.x when used with Spring Security, due to inconsistent path pattern matching on reserved framework routes. Accessing the /VAADIN endpoint without a trailing slash can bypass security filters, allowing unauthenticated...

Exploit for CVE-2026-22732

CVE-2026-22732 Demo Minimal reproduction of CVE-2026-22732...

Security Bulletin: Remediation of Multiple Spring Vulnerabilities in IBM Library Support for Spring

Summary Multiple Spring Vulnerabilities have been addressed in IBM Library Support for Spring Vulnerability Details CVEID:CVE-2026-22731 DESCRIPTION: Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.1.1

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Process Mining 2.1.1 Vulnerability Details CVEID:CVE-2026-22732 DESCRIPTION: When applications specify HTTP response headers for servlet applications using Spring...

CVE-2026-22738

creationtimestamp| type| source ---|---|--- 2026-03-26 20:05:49+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-288 2026-03-27 06:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116299610793227388 2026-03-27 06:00:31+00:00| seen|...

CVE-2026-22744

creationtimestamp| type| source ---|---|--- 2026-03-26 20:05:49+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-288 2026-03-27 07:18:31+00:00| seen| Telegram/tQ8akL20JB-7ffGjDDpJsYVoTg18MfzS3yyGF6GBW7nNPwo 2026-03-27 08:05:23+00:00| seen|...

CVE-2026-22743

creationtimestamp| type| source ---|---|--- 2026-03-26 20:05:49+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-288 2026-03-27 07:18:31+00:00| seen| Telegram/tQ8akL20JB-7ffGjDDpJsYVoTg18MfzS3yyGF6GBW7nNPwo 2026-03-27 08:14:21+00:00| seen|...

CVE-2026-22742

creationtimestamp| type| source ---|---|--- 2026-03-26 20:05:49+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-288 2026-03-27 07:00:49+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mhzkbsrncs2v 2026-03-27 07:18:31+00:00| seen|...

A Bootiful Podcast: Daniel Garnier-Moiroux on MCP Security

Hi Spring, AI, Spring AI, security, and Spring Security fans! In this installment I talk to the legendary Daniel-Garnier Moiroux! ai mcp security java...

This Week in Spring - March 24th, 2026

Hi, Spring fans! Welcome to yet another rip-roarin' installment of This Week in Spring. As usual, we've got a ton to look into, so let's dive right in! Happy 22nd birthday to Spring Framework, released this day 22 years ago! and of course, next week, 1 April 2026, marks 12 years since Spring Boot...

The vulnerability of the Java framework for securing industrial applications using Spring Security arises from the use of a non-safe direct reference to objects. This allows attackers to execute arbitrary code.

The vulnerability of the Java framework for securing industrial applications using Spring Security lies in the use of a potentially insecure direct reference to objects. Exploiting this vulnerability could allow an attacker to execute arbitrary code by sending a specially crafted HTTP request...

CVE-2026-22735

creationtimestamp| type| source ---|---|--- 2026-03-21 03:00:04+00:00| seen| https://spring.io/security/cve-2026-22737...

CVE-2026-22732

A flaw was found in Spring Security. When applications using Spring Security specify HTTP response headers for servlet applications, these headers may not be written. This can lead to a bypass of security policies or information disclosure, potentially allowing an attacker to gain unauthorized...

Use of Cache Containing Sensitive Information

Overview org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the process of writing HTTP response heade...

EUVD-2026-13349

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from...

Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from...

GHSA-MF92-479X-3373 Spring Security HTTP Headers Are not Written Under Some Conditions

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0...

Spring Security HTTP Headers Are not Written Under Some Conditions

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0...

EUVD-2026-13347

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0...

GHSA-MGVC-8Q2H-5PGC Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from...