CVE-2025-22223: Spring Security Vulnerable to Authorization Bypass via Security Annotations

March 24, 2025

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass.

You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or methods, or all method security annotations are attached to target methods

References

github.com/advisories/GHSA-hh3m-g4qj-4835
github.com/spring-projects/spring-security
github.com/spring-projects/spring-security/commit/dc2e1af2dab8ef81cd4edd25b56a2babeaab8cf9
nvd.nist.gov/vuln/detail/CVE-2025-22223
spring.io/security/cve-2025-22223

Code Behaviors & Features

Detect and mitigate CVE-2025-22223 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →