CVE-2025-41232— CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods
Quick assessment
Affected
Spring Spring Security
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
VMware Spring Security是美国威睿（VMware）公司的一套为基于Spring的应用程序提供说明性安全保护的安全框架。 VMware Spring Security 6.4.0至6.4.5版本存在安全漏洞，该漏洞源于未正确定位私有方法上的安全注解，可能导致授权绕过。
Possible ATT&CK Techniques 1 AI
T1528 · Steal Application Access Token
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-41232
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods
Source: CVE Program / CVE List V5
Vulnerability Description
Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.
Your application may be affected by this if the following are true:
* You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and
* You have Spring Security method annotations on a private method
In that case, the target method may be able to be invoked without proper authorization.
You are not affected if:
* You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or
* You have no Spring Security-annotated private methods
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
VMware Spring Security 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
VMware Spring Security是美国威睿（VMware）公司的一套为基于Spring的应用程序提供说明性安全保护的安全框架。 VMware Spring Security 6.4.0至6.4.5版本存在安全漏洞，该漏洞源于未正确定位私有方法上的安全注解，可能导致授权绕过。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Spring | Spring Security | 6.4.x ~ 6.4.6 | - |
|
II. Public POCs for CVE-2025-41232
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-41232
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Spring Security
-
CVE-2026-47838
Unauthorized User Impersonation when Using X.509 Client Cert -
CVE-2026-41706
Open Redirect When Using CookieRequestCache -
CVE-2026-41694
SAML Payloads Decrypted Without Valid Signature -
CVE-2026-41008
Spring Security Authorization Server Open Redirect via reque -
CVE-2026-41003
Unencoded HTML Outputs in Spring Security May Allow Cross-Si
Same vendor: Spring
-
CVE-2026-59318
DefaultToolCallingManager Global Resolver Fallback Allows Un -
CVE-2026-59308
Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Tru -
CVE-2026-59279
Unbounded persistent session allocation via repeated initial -
CVE-2026-59326
HTTP Proxy Credentials Logged in Plaintext by the Spring Boo -
CVE-2026-59328
Cross-Site Scripting in Eclipse Spring Boot Starter Wizard D
V. Comments for CVE-2025-41232
No comments yet