{"id":"CVE-2025-41248","aliases":["CLSA-2026-1775694712","EUVD-2025-29538","GHSA-8v5q-rhf3-jphm","ROOT-APP-MAVEN-CVE-2025-41248"],"status":"published","title":"CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types","description":"The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass.\n\nYour application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.\n\nYou are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.\n\nThis CVE is published in conjunction with  CVE-2025-41249 https://spring.io/security/cve-2025-41249 .","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0045,"percentile":0.39528,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-289","CWE-863"],"published":"2025-09-16T10:10:59Z","modified":"2026-11-02T19:45:20Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.security:spring-security-core","fixed_in":["6.4.10","6.5.4"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-core","fixed_in":["6.4.2-aikido.2","6.5.0-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-core","fixed_in":["6.4.2-root.io.2","6.5.0-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.0"},{"fixed":"6.5.4"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.1"}]}],"versions":["6.4.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.1"}]}],"versions":["6.4.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.1"}]}],"versions":["6.4.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.1"}]}],"versions":["6.4.3"],"bundled":5},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.10"}]}],"versions":["6.4.0","6.4.1","6.4.2","6.4.3","6.4.4","6.4.5","6.4.6","6.4.7","6.4.8","6.4.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.0"},{"fixed":"6.5.4"}]}],"versions":["6.5.0","6.5.1","6.5.2","6.5.3"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-aikido.2"},{"fixed":"6.5.0-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-root.io.2"},{"fixed":"6.5.0-root.io.2"}]}]}],"products":[{"vendor":"spring","product":"spring security"},{"vendor":"vmware","product":"spring security"}],"references":[{"url":"https://spring.io/security/cve-2025-41248","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-41248","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-security/issues/17898","tags":["web"]},{"url":"https://github.com/spring-projects/spring-security/issues/17899","tags":["web"]},{"url":"https://github.com/spring-projects/spring-security/commit/d0f93fa6d8338149943ae640c53db07de827867f","tags":["web"]},{"url":"https://github.com/spring-projects/spring-security/commit/e5694ac7b5e4394b920c6cab48b7bfbd871f84bd","tags":["web"]},{"url":"https://github.com/spring-projects/spring-security/releases/tag/6.4.10","tags":["web"]},{"url":"https://github.com/spring-projects/spring-security/releases/tag/6.5.4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8v5q-rhf3-jphm"},{"url":"https://github.com/spring-projects/spring-security","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-41248","title":"CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types","description":"The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass.\n\nYour application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.\n\nYou are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.\n\nThis CVE is published in conjunction with  CVE-2025-41249 https://spring.io/security/cve-2025-41249 .","status":"published","published":"2025-09-16T10:10:59.953Z","modified":"2025-09-18T06:29:51.189Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-289"],"updated_at":"2026-11-02T14:32:31.631102Z"}],"euvd":[{"id":"EUVD-2025-29538","description":"The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass.\n\nYour application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.\n\nYou are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.\n\nThis CVE is published in conjunction with  CVE-2025-41249 https://spring.io/security/cve-2025-41249 .","status":"published","published":"2025-09-16T10:10:59Z","modified":"2025-09-18T06:29:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:31:42.206486Z"}],"ghsa":[{"id":"GHSA-8v5q-rhf3-jphm","title":"Spring Security annotation detection mechanism has authorization bypass","description":"The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass.\n\nYour application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.\n\nYou are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.\n\nThis CVE is published in conjunction with  CVE-2025-41249 https://spring.io/security/cve-2025-41249 .","status":"published","published":"2025-09-16T15:32:34Z","modified":"2025-09-16T21:34:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-289","CWE-863"],"updated_at":"2026-11-02T14:38:58.107905Z"}],"nvd":[{"id":"CVE-2025-41248","description":"The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass.\n\nYour application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.\n\nYou are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.\n\nThis CVE is published in conjunction with  CVE-2025-41249 https://spring.io/security/cve-2025-41249 .","status":"published","published":"2025-09-16T11:15:30.257Z","modified":"2026-06-17T09:22:40.21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-289"],"updated_at":"2026-11-02T14:11:29.650057Z"}],"osv":[{"id":"GHSA-8v5q-rhf3-jphm","title":"Spring Security annotation detection mechanism has authorization bypass","description":"The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass.\n\nYour application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.\n\nYou are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.\n\nThis CVE is published in conjunction with  CVE-2025-41249 https://spring.io/security/cve-2025-41249 .","status":"published","published":"2025-09-16T15:32:34Z","modified":"2026-09-10T03:50:28.136685866Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-289","CWE-863"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"CLSA-2026-1775694712","title":"TuxCare security update for org.springframework.security (5 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 5 CVEs. Fixed in 6.4.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-11-02T19:45:20.39156813Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"ROOT-APP-MAVEN-CVE-2025-41248","title":"CVE-2025-41248 in org.springframework.security:spring-security-core - Patched by Root","description":"Root has patched CVE-2025-41248 in the org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-19T04:49:18Z","modified":"2026-09-19T05:15:03.227140023Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}