Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-22234 · ADVISORY
• spring-projects/spring-security · PACKAGE
• spring.io/security/cve-2025-22234 · WEB
• spring.io/security/cve-2025-22234

Weitere Schwachstellen in org.springframework.security:spring-security-core

• CVE-2026-22746NIEDRIG 3.7Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked …
• CVE-2026-22751MITTEL 4.8Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulner…
• CVE-2025-41248HOCH 7.5The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameter…
• CVE-2025-41232KRITISCH 9.1Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Yo…
• CVE-2025-22223MITTEL 5.3Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an auth…