CVE-2026-22753: Spring Security Auth Bypass Vulnerability

CVE-2026-22753 Overview

A security bypass vulnerability has been identified in Spring Security affecting versions 7.0.0 through 7.0.4. When an application uses securityMatchers(String) in combination with a PathPatternRequestMatcher.Builder bean to prepend a servlet path, the security filter chain matching mechanism can fail. This failure causes authentication, authorization, and other security controls to be bypassed on intended requests, potentially exposing protected resources to unauthorized access.

Critical Impact

Applications using the affected configuration pattern may have their security controls completely bypassed, allowing unauthenticated or unauthorized access to protected endpoints and resources.

Affected Products

• Spring Security 7.0.0
• Spring Security 7.0.1 through 7.0.4
• Applications using securityMatchers(String) with PathPatternRequestMatcher.Builder bean configuration

Discovery Timeline

• 2026-04-22 - CVE CVE-2026-22753 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-22753

Vulnerability Analysis

This vulnerability represents a Protection Mechanism Failure (CWE-693) in Spring Security's request matching subsystem. The flaw occurs when applications combine two specific configuration approaches: using securityMatchers(String) to define protected URL patterns and using a PathPatternRequestMatcher.Builder bean to prepend servlet paths to requests.

Under these conditions, the filter chain's request matching logic fails to correctly correlate incoming requests with their intended security configurations. As a result, the security filter chain that should process requests to protected endpoints is not activated, and security controls including authentication and authorization checks are not applied.

The vulnerability is exploitable over the network without requiring any authentication or user interaction, making it particularly concerning for internet-facing applications.

Root Cause

The root cause lies in the interaction between the securityMatchers(String) method and the PathPatternRequestMatcher.Builder bean when processing servlet paths. When a servlet path is prepended via the builder bean, the resulting request path does not match the patterns defined in securityMatchers(String), causing the security filter chain to fail its matching evaluation. This mismatch results in the request bypassing the intended security filter chain entirely.

Attack Vector

An attacker can exploit this vulnerability by sending network requests to endpoints that should be protected by Spring Security. Due to the filter chain matching failure, the attacker's requests bypass authentication and authorization checks, gaining access to resources that would normally require proper credentials and permissions.

The attack is straightforward to execute:

1. The attacker identifies an application using Spring Security 7.0.0 through 7.0.4
2. The attacker sends HTTP requests to protected endpoints
3. If the application uses the vulnerable configuration pattern, security controls are not applied
4. The attacker gains unauthorized access to protected resources

For detailed technical information on this vulnerability, refer to the Spring Security Advisory CVE-2026-22753.

Detection Methods for CVE-2026-22753

Indicators of Compromise

• Unexpected access to protected endpoints from unauthenticated users in application logs
• Missing authentication or authorization log entries for requests that should be protected
• Successful responses (HTTP 200) to protected endpoints without valid session or authentication tokens
• Anomalous patterns in access logs showing protected resources being accessed without prior authentication

Detection Strategies

• Review Spring Security configurations for applications using securityMatchers(String) combined with PathPatternRequestMatcher.Builder beans
• Audit web application logs for requests to protected endpoints that lack corresponding authentication entries
• Implement security testing to verify that authentication and authorization controls are being applied correctly
• Deploy application-layer monitoring to detect requests bypassing expected security filter chains

Monitoring Recommendations

• Enable verbose logging for Spring Security filter chain processing to identify matching failures
• Monitor application access patterns for unusual traffic to protected endpoints
• Implement alerting on successful access to sensitive endpoints without proper authentication headers
• Conduct regular security audits of Spring Security configurations in affected application versions

How to Mitigate CVE-2026-22753

Immediate Actions Required

• Upgrade Spring Security to version 7.0.5 or later, which contains the fix for this vulnerability
• Audit current application configurations to identify usage of securityMatchers(String) with PathPatternRequestMatcher.Builder beans
• Review access logs for potential unauthorized access that may have occurred prior to patching
• Implement additional network-level access controls as a temporary defense layer

Patch Information

Spring has released a security patch to address this vulnerability. Organizations should upgrade to Spring Security version 7.0.5 or later. For detailed patch information and upgrade guidance, refer to the Spring Security Advisory CVE-2026-22753.

Workarounds

• Avoid using securityMatchers(String) in combination with PathPatternRequestMatcher.Builder beans until the patch is applied
• Use alternative request matching approaches such as requestMatchers() with explicit AntPathRequestMatcher or MvcRequestMatcher configurations
• Implement servlet-level security filters as a secondary protection layer
• Consider using Spring Security's method-level security annotations (@PreAuthorize, @Secured) as an additional defense layer

# Verify Spring Security version in your application
# Maven projects
mvn dependency:tree | grep spring-security

# Gradle projects
./gradlew dependencies | grep spring-security

# Update to patched version in pom.xml
# <spring-security.version>7.0.5</spring-security.version>