Spring Security vulnerabilities
We track 4 vulnerabilities in Spring Security products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 16, 2026.
Latest Spring Security vulnerabilities
- 9.6 Critical severity
Spring Authorization Server: Improper Authentication
Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.
- 8.2 High severity
Spring Security: Missing Authorization
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the Aut
- 9.8 Critical severity
Spring Security: Improper Preservation of Permissions
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.
- 9.8 Critical severity
Spring Security: Incorrect Authorization
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression a