| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.boot:spring-boot-starter-actuator | ≥ 3.4.0, ≤ 3.4.13≥ 3.5.0, < 3.5.12≥ 4.0.0-M1, < 4.0.4 | 3.5.124.0.4 |
| spring boot | ≥ 3.4.0, < 3.4.15≥ 3.5.0, < 3.5.12≥ 4.0.0, < 4.0.4 | 3.4.153.5.124.0.4 |
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free