Summary
Servlet-path matching can deactivate security controls. This high-severity finding affects Spring Security.
Disclosure timeline
- Public disclosure
Credits
Cantina · Agent-discovered and human-verified
Vulnerability disclosure
Servlet-path matching can deactivate security controls
CVE-2026-22753
- Affected product
- Spring Security
- Severity
- High · CVSS 7.5
- Weakness
- CWE-693
- Disclosed