CVE-2026-22746: Spring Security Auth Bypass Vulnerability

CVE-2026-22746 Overview

CVE-2026-22746 is a timing attack vulnerability in Spring Security that affects the DaoAuthenticationProvider component. When an application utilizes the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes to manage user states (enable, expire, or lock users), the built-in timing attack defense mechanisms can be bypassed. This bypass specifically impacts users who are disabled, expired, or locked, potentially allowing attackers to enumerate valid usernames through observable differences in response times.

Critical Impact

Attackers can potentially bypass timing attack defenses to enumerate valid user accounts that are in disabled, expired, or locked states, which could facilitate further targeted attacks.

Affected Products

• Spring Security 5.7.0 through 5.7.22
• Spring Security 5.8.0 through 5.8.24
• Spring Security 6.3.0 through 6.3.15
• Spring Security 6.5.0 through 6.5.9
• Spring Security 7.0.0 through 7.0.4

Discovery Timeline

• April 22, 2026 - CVE-2026-22746 published to NVD
• April 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22746

Vulnerability Analysis

This vulnerability (CWE-208: Observable Timing Discrepancy) exists in Spring Security's DaoAuthenticationProvider implementation. The timing attack defense mechanism is designed to prevent attackers from determining whether a username exists based on response time differences during authentication attempts. However, when user account status checks (isEnabled, isAccountNonExpired, isAccountNonLocked) are performed, the defense mechanism fails to properly normalize response times for accounts in disabled, expired, or locked states.

The flaw allows an attacker to observe timing differences between authentication attempts against active accounts versus accounts that have been administratively disabled, expired, or locked. This side-channel information leakage can be leveraged to enumerate valid usernames in the system, even when those accounts are not currently accessible.

Root Cause

The root cause lies in the order of operations within DaoAuthenticationProvider. The timing attack defense typically ensures that password verification takes a consistent amount of time regardless of whether a user exists. However, when the user exists but fails one of the account status checks (isEnabled, isAccountNonExpired, or isAccountNonLocked), the authentication flow takes a different code path that does not apply the same timing normalization. This creates an observable timing discrepancy that can be measured and exploited.

Attack Vector

The attack is network-based and can be executed without authentication. An attacker sends multiple authentication requests to the target application and measures the response times. By analyzing statistical differences in response latencies, the attacker can identify:

1. Usernames that do not exist (timing profile A)
2. Usernames that exist but are disabled, expired, or locked (timing profile B)
3. Usernames that exist and are active (timing profile C)

This enumeration technique requires high attack complexity due to the need for precise timing measurements and statistical analysis, but can be automated with specialized tools. The attack does not require user interaction and is limited to information disclosure (username enumeration).

Detection Methods for CVE-2026-22746

Indicators of Compromise

• Unusually high volume of failed authentication attempts from a single source IP or small range of IPs
• Authentication attempts with a pattern suggesting systematic username enumeration
• Login attempts targeting known or suspected disabled/locked user accounts
• Statistical anomalies in authentication request patterns

Detection Strategies

• Monitor authentication logs for high-frequency failed login attempts that suggest enumeration activity
• Implement rate limiting on authentication endpoints and alert on threshold breaches
• Deploy application performance monitoring (APM) to detect unusual patterns in authentication endpoint response times
• Correlate authentication failures with account status to identify targeted attacks against disabled/locked accounts

Monitoring Recommendations

• Enable detailed logging for all authentication events including timestamps and source IPs
• Configure SIEM alerts for authentication anomalies such as rapid sequential login attempts
• Monitor for reconnaissance patterns that may precede credential stuffing or brute force attacks
• Review Spring Security audit logs regularly for evidence of timing-based enumeration attempts

How to Mitigate CVE-2026-22746

Immediate Actions Required

• Upgrade Spring Security to a patched version as soon as updates are available from VMware/Spring
• Review applications for usage of UserDetails#isEnabled, #isAccountNonExpired, and #isAccountNonLocked attributes
• Implement additional rate limiting on authentication endpoints to make timing attacks more difficult
• Consider implementing CAPTCHA or progressive delays for failed authentication attempts

Patch Information

VMware/Spring has acknowledged this vulnerability. For detailed patch information and recommended upgrade paths, refer to the Spring Security CVE-2026-22746 Advisory. Organizations should upgrade to the latest patched versions of Spring Security in their respective version lines.

Workarounds

• Implement custom timing normalization by adding artificial delays to all authentication responses
• Use a Web Application Firewall (WAF) to rate limit and detect enumeration attempts on authentication endpoints
• Consider temporarily disabling detailed account status messages until patches can be applied
• Deploy network-level protections to limit authentication request rates from individual sources

# Example: Configure rate limiting in nginx as a temporary mitigation
# Add to server block configuration for authentication endpoints
limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=5r/s;

location /login {
    limit_req zone=auth_limit burst=10 nodelay;
    proxy_pass http://spring_app;
}