Critical severity9.1GHSA Advisory· Published May 21, 2025· Updated Apr 15, 2026
CVE-2025-41232
CVE-2025-41232
Description
Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.
Your application may be affected by this if the following are true:
* You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and * You have Spring Security method annotations on a private method In that case, the target method may be able to be invoked without proper authorization.
You are not affected if:
- You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or
- You have no Spring Security-annotated private methods
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.springframework.security:spring-security-aspectsMaven | >= 6.4.0, < 6.4.6 | 6.4.6 |
org.springframework.security:spring-security-coreMaven | >= 6.4.0, < 6.4.6 | 6.4.6 |
Affected products
3- Range: >= 6.4.0, < 6.4.6
- ghsa-coords2 versionspkg:maven/org.springframework.security/spring-security-aspectspkg:maven/org.springframework.security/spring-security-core
>= 6.4.0, < 6.4.6+ 1 more
- (no CPE)range: >= 6.4.0, < 6.4.6
- (no CPE)range: >= 6.4.0, < 6.4.6
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-9pp5-9c7g-4r83ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-41232ghsaADVISORY
- spring.io/security/cve-2025-41232nvdWEB
- github.com/spring-projects/spring-security/commit/bf2aaa1b1830e534ba651d422545ac08a115151bghsaWEB
- github.com/spring-projects/spring-security/commit/c972de5369a1261ab674a3f5e3a80e8ce3e8cdfbghsaWEB
- github.com/spring-projects/spring-security/releases/tag/6.4.6ghsaWEB
News mentions
0No linked articles in our index yet.