7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-41248

CVE-2025-41248: Spring Security annotation detection mechanism has authorization bypass

The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass.

Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.

You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.

This CVE is published in conjunction with CVE-2025-41249 https://spring.io/security/cve-2025-41249 .

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-41248

CVE-2025-41248:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.springframework.security:spring-security-core	maven	>= 6.4.0, < 6.4.10	6.4.10
org.springframework.security:spring-security-core	maven	>= 6.5.0, < 6.5.4	6.5.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in Spring Security's mechanism for detecting security annotations on methods, specifically when dealing with generic type hierarchies. The root cause is a bug in the org.springframework.security.core.annotation.UniqueSecurityAnnotationScanner.hasSameGenericTypeParameters method. This method incorrectly compared method signatures when a method in a subclass inherited from a superclass with unbounded generic parameters. The use of ResolvableType.resolve() returned null for these generics, causing the method matching to fail.

This bug is exposed through the public scan method of the UniqueSecurityAnnotationScanner. When an application using @EnableMethodSecurity tries to secure a method that falls into this specific generic inheritance scenario, the scan method is called to find the security annotations (like @PreAuthorize). Due to the bug in hasSameGenericTypeParameters, the scan method fails to find the annotation and returns no security metadata. This leads to Spring Security treating the method as if it has no security constraints, resulting in a complete authorization bypass.

The patch addresses the issue by changing .resolve() to .toClass(). This ensures that even if a generic type is unbounded, it is resolved to java.lang.Object, allowing the method comparison to succeed and the security annotation to be correctly identified. Therefore, both the scan method (the entry point) and the hasSameGenericTypeParameters method (the location of the bug) are critical to understanding this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.