{"id":"CVE-2024-22234","aliases":["CLSA-2026-1768349319","EUVD-2024-0745","GHSA-w3w6-26f2-p474","ROOT-APP-MAVEN-CVE-2024-22234"],"status":"published","title":"CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated","description":"In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method.\n\nSpecifically, an application is vulnerable if:\n\n  *  The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value.\n\n\nAn application is not vulnerable if any of the following is true:\n\n  *  The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly.\n  *  The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated\n  *  The application only uses isFullyAuthenticated via  Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html  or  HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00682,"percentile":0.52948,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2024-02-20T07:02:50Z","modified":"2026-11-02T19:45:12Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.security:spring-security-core","fixed_in":["6.1.7","6.2.2"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-core","fixed_in":["6.1.3-root.io.2","6.1.3-root.io.4","6.2.0-root.io.1","6.1.3-root.io.5","6.2.0-root.io.2","6.2.0-root.io.3","6.2.0-root.io.4","6.1.3-root.io.6","6.1.3-root.io.7","6.2.0-root.io.5"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-core","fixed_in":["6.1.3-aikido.5","6.2.0-aikido.2","6.2.0-aikido.3","6.2.0-aikido.4","6.1.3-aikido.6","6.1.3-aikido.7","6.2.0-aikido.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.1.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.2"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.1"}]}],"versions":["6.1.6"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.1"}]}],"versions":["6.1.6"],"bundled":4},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.1.7"}]}],"versions":["6.1.0","6.1.1","6.1.2","6.1.3","6.1.4","6.1.5","6.1.6"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.2"}]}],"versions":["6.2.0","6.2.1"]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.3-root.io.2"},{"fixed":"6.1.3-root.io.4"},{"fixed":"6.2.0-root.io.1"},{"fixed":"6.1.3-root.io.5"},{"fixed":"6.2.0-root.io.2"},{"fixed":"6.2.0-root.io.3"},{"fixed":"6.2.0-root.io.4"},{"fixed":"6.1.3-root.io.6"},{"fixed":"6.1.3-root.io.7"},{"fixed":"6.2.0-root.io.5"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.3-aikido.5"},{"fixed":"6.2.0-aikido.2"},{"fixed":"6.2.0-aikido.3"},{"fixed":"6.2.0-aikido.4"},{"fixed":"6.1.3-aikido.6"},{"fixed":"6.1.3-aikido.7"},{"fixed":"6.2.0-aikido.5"}]}]}],"products":[{"vendor":"spring","product":"spring security"},{"vendor":"vmware","product":"spring_security"}],"references":[{"url":"https://spring.io/security/cve-2024-22234","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240315-0003/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22234","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-security/commit/750cb30ce44d279c2f54c845d375e6a58bded569","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20240315-0003","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w3w6-26f2-p474"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22234.json","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-security","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-22234","title":"CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated","description":"In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method.\n\nSpecifically, an application is vulnerable if:\n\n  *  The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value.\n\n\nAn application is not vulnerable if any of the following is true:\n\n  *  The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly.\n  *  The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated\n  *  The application only uses isFullyAuthenticated via  Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html  or  HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html","status":"published","published":"2024-02-20T07:02:50.873Z","modified":"2025-02-13T17:33:37.468Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:00.254134Z"}],"euvd":[{"id":"EUVD-2024-0745","description":"In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method.\n\nSpecifically, an application is vulnerable if:\n\n  *  The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value.\n\n\nAn application is not vulnerable if any of the following is true:\n\n  *  The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly.\n  *  The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated\n  *  The application only uses isFullyAuthenticated via  Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html  or  HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html","status":"published","published":"2024-02-20T07:02:50Z","modified":"2025-02-13T17:33:37Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:03:47.088299Z"}],"ghsa":[{"id":"GHSA-w3w6-26f2-p474","title":"Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated","description":"In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method.\n\nSpecifically, an application is vulnerable if:\n\n  *  The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value.\n\n\nAn application is not vulnerable if any of the following is true:\n\n  *  The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly.\n  *  The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated\n  *  The application only uses isFullyAuthenticated via  Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html  or  HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html","status":"published","published":"2024-02-20T09:30:30Z","modified":"2026-03-14T05:09:02Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:39:35.644357Z"}],"nvd":[{"id":"CVE-2024-22234","description":"In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method.\n\nSpecifically, an application is vulnerable if:\n\n  *  The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value.\n\n\nAn application is not vulnerable if any of the following is true:\n\n  *  The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly.\n  *  The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated\n  *  The application only uses isFullyAuthenticated via  Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html  or  HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html","status":"published","published":"2024-02-20T07:15:09.967Z","modified":"2026-06-17T07:10:59.967Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:09:37.655131Z"}],"osv":[{"id":"CVE-2024-22234","title":"CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated","description":"In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method.\n\nSpecifically, an application is vulnerable if:\n\n  *  The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value.\n\n\nAn application is not vulnerable if any of the following is true:\n\n  *  The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly.\n  *  The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated\n  *  The application only uses isFullyAuthenticated via  Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html  or  HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html","status":"published","published":"2024-02-20T07:02:50.873Z","modified":"2026-10-28T02:30:51.17689803Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"GHSA-w3w6-26f2-p474","title":"Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated","description":"In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method.\n\nSpecifically, an application is vulnerable if:\n\n  *  The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value.\n\n\nAn application is not vulnerable if any of the following is true:\n\n  *  The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly.\n  *  The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated\n  *  The application only uses isFullyAuthenticated via  Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html  or  HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html","status":"published","published":"2024-02-20T09:30:30Z","modified":"2025-02-13T19:36:07.72174Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"ROOT-APP-MAVEN-CVE-2024-22234","title":"CVE-2024-22234 in io.root.org.springframework.security:spring-security-core - Patched by Root","description":"Root has patched CVE-2024-22234 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-07-29T14:45:04Z","modified":"2026-07-29T19:00:14.153216776Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"CLSA-2026-1768349319","title":"TuxCare security update for org.springframework.security (4 CVEs)","description":"TuxCare rebuilt 2 org.springframework.security packages to address 4 CVEs. Fixed in 6.1.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:12.284545187Z","updated_at":"2026-11-02T20:30:40.499236Z"}]}}