CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods
9.1
Basic Information
Technical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.springframework.security:spring-security-aspects | maven | >= 6.4.0, < 6.4.6 | 6.4.6 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability description points to an issue with Spring Security Aspects not correctly locating method security annotations on private methods. The provided commit bf2aaa1b1830e534ba651d422545ac08a115151b directly addresses this by changing how methods are compared within the UniqueSecurityAnnotationScanner. The change from == to .equals() in the findMethod function is the core of the fix. This incorrect comparison would lead to annotations not being found, especially in AspectJ scenarios where methods might be proxied. The PreAuthorizeAspectTests.java file modification further supports that this area was being tested and fixed. The spring-security-aspects package is where AspectJ integration for Spring Security resides, and UniqueSecurityAnnotationScanner is a core component used in this process for discovering annotations.