Security
فارسی
All products

org.springframework.security:spring-security-core

Maven · Package
31 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configuredCVE-2026-22751 · GHSA-X2WQ-9X2F-FHJ7 org.springframework.security:spring-security-coreOpenShift Developer Tools and Services/jenkins MavenRed Hat Medium Fix reported
Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProviderCVE-2026-22746 · GHSA-VXF7-QJ7Q-83FH org.springframework.security:spring-security-coreOpenShift Developer Tools and Services/jenkins MavenRed Hat Low Fix reported
Spring Security annotation detection mechanism has authorization bypassCVE-2025-41248 · GHSA-8V5Q-RHF3-JPHM org.springframework.security:spring-security-coreRed Hat Data Grid 8/spring-security-core MavenRed Hat High Fix reported
Spring Framework has Authorization Bypass for Case Sensitive ComparisonsCVE-2024-38827 · GHSA-Q3V6-HM2V-PW99 org.springframework.security:spring-security-coreOpenShift Developer Tools and Services/spring-security-core MavenRed Hat Medium Fix reported
Erroneous authentication pass in Spring SecurityCVE-2024-22257 · GHSA-F3JH-QVM4-MG39 org.springframework.security:spring-security-coreOpenShift Developer Tools and Services/jenkins MavenRed Hat High Fix reported
Spring Security Vulnerable to Authorization Bypass via Security AnnotationsCVE-2025-22223 · GHSA-HH3M-G4QJ-4835 org.springframework.security:spring-security-coreRed Hat Fuse 7/org.apache.servicemix.bundles.spring-security-core MavenRed Hat Medium Fix reported
Broken Access Control in Spring Security With Direct Use of isFullyAuthenticatedCVE-2024-22234 · GHSA-W3W6-26F2-P474 org.springframework.security:spring-security-coreOpenShift Developer Tools and Services/jenkins MavenRed Hat High Fix reported
Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvideCVE-2025-22234 · GHSA-VQXH-445G-37FC org.springframework.security:spring-security-coreOpenShift Developer Tools and Services/ocp-tools-4/jenkins-rhel8 MavenRed Hat Medium Fix reported
Spring Security authorization bypass for method security annotations on private methodsCVE-2025-41232 · GHSA-9PP5-9C7G-4R83 org.springframework.security:spring-security-aspectsorg.springframework.security:spring-security-core Maven Critical Fix reported
Spring Security Missing Authorization vulnerabilityCVE-2024-38810 · GHSA-HMQF-WPQ9-JQ83 org.springframework.security:spring-security-core Maven Medium Fix reported
Concurrent Execution using Shared Resource with Improper Synchronization in Spring SecurityCVE-2011-2731 · GHSA-4644-HG35-55M9 org.springframework.security:spring-security-core Maven Medium Fix reported
Exposure of Sensitive Information to an Unauthorized Actor in Spring SecurityCVE-2012-5055 · GHSA-3533-RVPC-6X56 org.springframework.security:spring-security-core Maven Medium Fix reported
Improper Control of Generation of Code in Spring SecurityCVE-2011-2732 · GHSA-5XM9-RF63-WJ7H org.springframework.security:spring-security-core Maven Medium Fix reported
Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi SecurityCVE-2010-3700 · GHSA-3295-H9QX-R82X org.acegisecurity:acegi-securityorg.springframework.security:spring-security-core Maven Medium Fix reported
Spring Framework and Spring Security vulnerable to Deserialization of Untrusted DataCVE-2011-2894 · GHSA-F866-M9MV-2XR3 org.springframework.security:spring-security-coreorg.springframework:spring-core Maven Medium Fix reported
Spring Security and Spring Framework may not recognize certain paths that should be protectedCVE-2016-5007 · GHSA-8CRV-49FR-2H6J org.springframework.security:spring-security-coreorg.springframework:spring-core MavenRed Hat High Fix reported
Security Constraint Bypass in Spring SecurityCVE-2016-9879 · GHSA-V35C-49J6-Q8HQ org.springframework.security:spring-security-coreRed Hat JBoss Fuse 6/camel MavenRed Hat High Fix reported
Authorization bypass in Spring SecurityCVE-2022-22978 · GHSA-HH32-7344-CG2F org.springframework.security:spring-security-coreorg.springframework.security:spring-security-web MavenRed Hat Critical Fix reported
Integer overflow in BCrypt class in Spring SecurityCVE-2022-22976 · GHSA-WX54-3278-M5G4 org.springframework.security:spring-security-coreRed Hat Decision Manager 7/springframework MavenRed Hat Medium Fix reported
Authorization Bypass in Spring SecurityCVE-2014-3527 · GHSA-WMV4-5W76-VP9G org.springframework.security:spring-security-core Maven Critical Fix reported