CVE-2026-22746

Overview

Vulnerability in Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.

Details

Module Info

• Product: Spring
• Affected packages: spring-security-core
• Affected versions: 4.2.x; 5.5.x; 5.7.x; 5.8.x; 6.2.x; 6.3.x; 6.4.x; 6.5.x; 7.0.x
• GitHub repository: https://github.com/spring-projects/spring-security
• Published packages: https://central.sonatype.com/artifact/org.springframework.security/spring-security-core
• Package manager: Maven
• Fixed In: NES for Spring
• Fix date: 2026-04-21
• Severity: Low
• Category: Authorization Bypass

‍

Vulnerability Info

Vulnerability in Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.

‍

Mitigation

Only recent versions of Spring Framework receive community support and updates. Older versions have no publicly available fixes for this vulnerability.Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Framework.
• Leverage a commercial support partner like HeroDevs for post-EOL security support through Never-Ending Support (NES) for Spring Framework.

‍

Steps To Reproduce

1. Set up the affected environment: Deploy an application using Spring Security with one of the affected versions. Ensure that the application is configured to utilize the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked attributes for user authentication.
2. Create user accounts: Set up multiple user accounts with varying states: one enabled, one disabled, one expired, and one locked. Ensure that the user details are correctly configured to reflect these states.
3. Trigger authentication requests: Attempt to authenticate using the credentials of the disabled, expired, and locked user accounts. Monitor the response times for each authentication attempt to observe any discrepancies.
4. Analyze response times: Document the response times for each authentication attempt. A significant difference in response times when authenticating against disabled, expired, or locked accounts may indicate a successful timing attack vulnerability.
5. Upgrade Spring Security: Apply the appropriate fix for your version of Spring Security as per the advisory
6. Re-test authentication requests: After upgrading, repeat the authentication attempts for the disabled, expired, and locked user accounts.
7. Verify remediation: Confirm that the response times for all authentication attempts are consistent and do not exhibit significant differences, indicating that the timing attack vulnerability has been effectively mitigated.