CVE-2026-22753
Spring Security
CVSS Details
CVSS Score
7.5 HIGH
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-693 Protection Mechanism Failure
Description
Vulnerability in Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the application. This can lead to the authentication, authorization, and other security controls being rendered inactive on intended requests. This issue affects Spring Security: from 7.0.0 through 7.0.4.
Timeline
Discovered
April 2026
Vendor Notified
April 2026
Patch Released
April 22, 2026 (v7.0.5)
Public Disclosure
April 22, 2026