{"id":"CVE-2025-41232","aliases":["EUVD-2025-15999","GHSA-9pp5-9c7g-4r83","ROOT-APP-MAVEN-CVE-2025-41232"],"status":"published","title":"CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods","description":"Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.\n\nYour application may be affected by this if the following are true:\n\n  *  You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and\n  *  You have Spring Security method annotations on a private method\nIn that case, the target method may be able to be invoked without proper authorization.\n\nYou are not affected if:\n\n  *  You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or\n  *  You have no Spring Security-annotated private methods","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00627,"percentile":0.50519,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693"],"published":"2025-05-21T10:23:07Z","modified":"2026-09-18T14:15:03Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.security:spring-security-aspects","fixed_in":["6.4.6"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.springframework.security:spring-security-core","fixed_in":["6.4.6"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-core","fixed_in":["6.4.2-aikido.2","6.4.2-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-core","fixed_in":["6.4.2-root.io.2","6.4.2-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-aspects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.6"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-aspects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.6"}]}],"versions":["6.4.0","6.4.1","6.4.2","6.4.3","6.4.4","6.4.5"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.6"}]}],"versions":["6.4.0","6.4.1","6.4.2","6.4.3","6.4.4","6.4.5"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-aikido.2"},{"fixed":"6.4.2-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-root.io.2"},{"fixed":"6.4.2-root.io.1"}]}]}],"products":[{"vendor":"spring","product":"spring security"}],"references":[{"url":"http://spring.io/security/cve-2025-41232","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-41232","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-security/commit/bf2aaa1b1830e534ba651d422545ac08a115151b","tags":["web"]},{"url":"https://github.com/spring-projects/spring-security/commit/c972de5369a1261ab674a3f5e3a80e8ce3e8cdfb","tags":["web"]},{"url":"https://github.com/spring-projects/spring-security/releases/tag/6.4.6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9pp5-9c7g-4r83"},{"url":"https://github.com/spring-projects/spring-security","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-41232","title":"CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods","description":"Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.\n\nYour application may be affected by this if the following are true:\n\n  *  You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and\n  *  You have Spring Security method annotations on a private method\nIn that case, the target method may be able to be invoked without proper authorization.\n\nYou are not affected if:\n\n  *  You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or\n  *  You have no Spring Security-annotated private methods","status":"published","published":"2025-05-21T10:23:07.078Z","modified":"2026-02-26T18:28:04.26Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:32:31.631102Z"}],"euvd":[{"id":"EUVD-2025-15999","description":"Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.\n\nYour application may be affected by this if the following are true:\n\n  *  You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and\n  *  You have Spring Security method annotations on a private method\nIn that case, the target method may be able to be invoked without proper authorization.\n\nYou are not affected if:\n\n  *  You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or\n  *  You have no Spring Security-annotated private methods","status":"published","published":"2025-05-21T10:23:07Z","modified":"2026-02-26T18:28:04Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:48:18.130322Z"}],"ghsa":[{"id":"GHSA-9pp5-9c7g-4r83","title":"Spring Security authorization bypass for method security annotations on private methods","description":"Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.\n\nYour application may be affected by this if the following are true:\n\n  *  You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and\n  *  You have Spring Security method annotations on a private method\nIn that case, the target method may be able to be invoked without proper authorization.\n\nYou are not affected if:\n\n  *  You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or\n  *  You have no Spring Security-annotated private methods","status":"published","published":"2025-05-21T15:30:33Z","modified":"2025-10-15T20:13:16Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:39:01.677422Z"}],"nvd":[{"id":"CVE-2025-41232","description":"Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.\n\nYour application may be affected by this if the following are true:\n\n  *  You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and\n  *  You have Spring Security method annotations on a private method\nIn that case, the target method may be able to be invoked without proper authorization.\n\nYou are not affected if:\n\n  *  You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or\n  *  You have no Spring Security-annotated private methods","status":"published","published":"2025-05-21T12:16:21.993Z","modified":"2026-06-17T09:22:38.57Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:11:09.125937Z"}],"osv":[{"id":"GHSA-9pp5-9c7g-4r83","title":"Spring Security authorization bypass for method security annotations on private methods","description":"Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.\n\nYour application may be affected by this if the following are true:\n\n  *  You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and\n  *  You have Spring Security method annotations on a private method\nIn that case, the target method may be able to be invoked without proper authorization.\n\nYou are not affected if:\n\n  *  You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or\n  *  You have no Spring Security-annotated private methods","status":"published","published":"2025-05-21T15:30:33Z","modified":"2025-10-16T08:04:55.703819Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"ROOT-APP-MAVEN-CVE-2025-41232","title":"CVE-2025-41232 in org.springframework.security:spring-security-core - Patched by Root","description":"Root has patched CVE-2025-41232 in the org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-18T13:08:42Z","modified":"2026-09-18T14:15:03.8113723Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}