Open-source package vulnerability · Maven

CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods

criticalCVSS 3.1 9.1GHSA-9pp5-9c7g-4r83

Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and You have Spring Security method annotations on a private method In that case, the target method may be able to be invoked without…

Published May 21, 2025 · Updated Oct 15, 2025

Affected packages

org.springframework.security:spring-security-aspects

Ecosystem: Maven
Affected: >= 6.4.0, < 6.4.6
Fixed in: 6.4.6
Check: mvn dependency:tree -Dincludes=org.springframework.security:spring-security-aspects

org.springframework.security:spring-security-core

Ecosystem: Maven
Affected: >= 6.4.0, < 6.4.6
Fixed in: 6.4.6
Check: mvn dependency:tree -Dincludes=org.springframework.security:spring-security-core

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.

Your application may be affected by this if the following are true:

You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and
You have Spring Security method annotations on a private method

In that case, the target method may be able to be invoked without proper authorization.

You are not affected if:

You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or
You have no Spring Security-annotated private methods

Credited to tomabai.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology