CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods
9.1
Basic Information
Technical Details
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
org.springframework.security:spring-security-aspects | maven | >= 6.4.0, < 6.4.6 | 6.4.6 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability description points to an issue with Spring Security Aspects not correctly locating method security annotations on private methods. The provided commit bf2aaa1b1830e534ba651d422545ac08a115151b
directly addresses this by changing how methods are compared within the UniqueSecurityAnnotationScanner
. The change from ==
to .equals()
in the findMethod
function is the core of the fix. This incorrect comparison would lead to annotations not being found, especially in AspectJ scenarios where methods might be proxied. The PreAuthorizeAspectTests.java
file modification further supports that this area was being tested and fixed. The spring-security-aspects
package is where AspectJ integration for Spring Security resides, and UniqueSecurityAnnotationScanner
is a core component used in this process for discovering annotations.