Miggo Logo

CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods

9.1

CVSS Score
3.1

Basic Information

EPSS Score
0.17905%
Published
5/21/2025
Updated
5/21/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.springframework.security:spring-security-aspectsmaven>= 6.4.0, < 6.4.66.4.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description points to an issue with Spring Security Aspects not correctly locating method security annotations on private methods. The provided commit bf2aaa1b1830e534ba651d422545ac08a115151b directly addresses this by changing how methods are compared within the UniqueSecurityAnnotationScanner. The change from == to .equals() in the findMethod function is the core of the fix. This incorrect comparison would lead to annotations not being found, especially in AspectJ scenarios where methods might be proxied. The PreAuthorizeAspectTests.java file modification further supports that this area was being tested and fixed. The spring-security-aspects package is where AspectJ integration for Spring Security resides, and UniqueSecurityAnnotationScanner is a core component used in this process for discovering annotations.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Sprin* S**urity *sp**ts m*y not *orr**tly lo**t* m*t*o* s**urity *nnot*tions on priv*t* m*t*o*s. T*is **n **us* *n *ut*oriz*tion *yp*ss. Your *ppli**tion m*y ** *****t** *y t*is i* t** *ollowin* *r* tru*: * You *r* usin* @*n**l*M*t*o*S**urity(mo

Reasoning

T** vuln*r**ility **s*ription points to *n issu* wit* Sprin* S**urity *sp**ts not *orr**tly lo**tin* m*t*o* s**urity *nnot*tions on priv*t* m*t*o*s. T** provi*** *ommit `****************************************` *ir**tly ***r*ss*s t*is *y ***n*in* *o