CVE-2026-22733 - Vulnerability Analysis

Overview

Spring Security 2.7.0 through 2.7.31, 3.3.0 through 3.3.17, 3.4.0 through 3.4.14, 3.5.0 through 3.5.11, and 4.0.0 through 4.0.3 contain an authentication bypass caused by endpoint path conflicts with CloudFoundry Actuator endpoints, letting attackers bypass authentication, exploit requires misconfigured endpoint paths.

Severity & Score

Impact

Attackers can bypass authentication, gaining unauthorized access to protected application endpoints.

Mitigation

Update to a version later than 4.0.3, 3.5.11, 3.4.14, 3.3.17, and 2.7.31 or the latest available version.

References

• https://spring.io/security/cve-2026-22733

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner