| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.security:spring-security-core | ≥ 6.3.8, < 6.3.9≥ 6.4.4, < 6.4.5 | 6.3.96.4.5 |
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free