CVE-2025-41232

Critical

Description

Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: * You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and * You have Spring Security method annotations on a private method In that case, the target method may be able to be invoked without proper authorization. You are not affected if: * You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or * You have no Spring Security-annotated private methods

SeverityCritical

CVSS9.1

Exploit probability—

ProductOrg.springframework.security:spring-security-aspects

PublishedMay 21, 2025

First seenMay 21, 2025

Weakness typeCWE-693CWE-693

How to fix

Update

org.springframework.security:spring-security-aspects6.4.6 or later
org.springframework.security:spring-security-core6.4.6 or later

Affected products

Product	Affected versions	Fixed in
org.springframework.security:spring-security-aspectsMaven	6.4.0 ≤ v < 6.4.6	6.4.6
org.springframework.security:spring-security-coreMaven	6.4.0 ≤ v < 6.4.6	6.4.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.