Authorization Bypass

🗓️ 10 Oct 2025 07:26:30Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 4 Views

Authorization bypass in spring security core due to annotation resolution in type hierarchies.

Reporter	Title	Published	Views	Family All 78
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for December 2025 - Multiple CVEs addressed	29 Jan 202607:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is affected by a vulnerability in spring-security-core-6.4.3.jar (CVE-2025-41248)	7 Oct 202507:19	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerability in Spring Security Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-41248)	12 Jun 202618:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Improper Authorization in Spring Framework [CVE-2025-41249]	17 Dec 202514:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in spring-security-core (CVE-2025-41248)	10 Mar 202610:14	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.1.0	5 Dec 202509:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway	12 Jun 202618:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	9 Dec 202515:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability has addressed Multiple Vulnerabilities within Instana Agent container image	3 Mar 202613:53	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring Framework affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	22 Jun 202613:41	–	ibm

Vulners

Node

springframework spring-security-coreRange6.4.0-M1–6.4.9java

springframework spring-security-coreRange6.5.0-M1–6.5.3java

springframework spring-security-coreRange6.4.0–6.4.9java

springframework spring-security-coreRange6.5.0–6.5.3java

Source	Link
github	www.github.com/spring-projects/spring-security/commit/d0f93fa6d8338149943ae640c53db07de827867f
spring	www.spring.io/security/cve-2025-41248
github	www.github.com/spring-projects/spring-security/releases/tag/6.5.4
github	www.github.com/spring-projects/spring-security/releases/tag/6.4.10
github	www.github.com/spring-projects/spring-security/issues/17898
github	www.github.com/spring-projects/spring-security/commit/e5694ac7b5e4394b920c6cab48b7bfbd871f84bd
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-41248
github	www.github.com/spring-projects/spring-security/issues/17899
github	www.github.com/spring-projects/spring-security

22 Jun 2026 15:49Current

7High risk

Vulners AI Score7

CVSS 3.17.5

EPSS0.00433

SSVC