VYPR
Get started
← All advisories
Critical severity9.1NVD Advisory· Published May 21, 2025· Updated Apr 15, 2026

CVE-2025-41232

CVE-2025-41232

Description

Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.

Your application may be affected by this if the following are true:

* You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and * You have Spring Security method annotations on a private method In that case, the target method may be able to be invoked without proper authorization.

You are not affected if:

  • You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or
  • You have no Spring Security-annotated private methods

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.springframework.security:spring-security-aspectsMaven
>= 6.4.0, < 6.4.66.4.6
org.springframework.security:spring-security-coreMaven
>= 6.4.0, < 6.4.66.4.6

Patches

2
bf2aaa1b1830

Use .equals to Compare Methods

https://github.com/spring-projects/spring-securityJosh CummingsApr 29, 2025via ghsa
commit
2 files changed · +4 −4
  • aspects/src/test/java/org/springframework/security/authorization/method/aspectj/PreAuthorizeAspectTests.java+2 −2 modified
    @@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -144,7 +144,7 @@ private void privateMethod() {
 		protected void protectedMethod() {
 		}
 
-		@PreAuthorize("hasRole('X')")
+		@PreAuthorize("hasRole('A')")
 		void publicCallsPrivate() {
 			privateMethod();
 		}
  • core/src/main/java/org/springframework/security/core/annotation/UniqueSecurityAnnotationScanner.java+2 −2 modified
    @@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -214,7 +214,7 @@ private List<MergedAnnotation<A>> findDirectAnnotations(AnnotatedElement element
 
 	private static Method findMethod(Method method, Class<?> targetClass) {
 		for (Method candidate : targetClass.getDeclaredMethods()) {
-			if (candidate == method) {
+			if (candidate.equals(method)) {
 				return candidate;
 			}
 			if (isOverride(method, candidate)) {
c972de5369a1

Use .equals to Compare Methods

https://github.com/spring-projects/spring-securityJosh CummingsApr 29, 2025via ghsa
commit
2 files changed · +4 −4
  • aspects/src/test/java/org/springframework/security/authorization/method/aspectj/PreAuthorizeAspectTests.java+2 −2 modified
    @@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -144,7 +144,7 @@ private void privateMethod() {
 		protected void protectedMethod() {
 		}
 
-		@PreAuthorize("hasRole('X')")
+		@PreAuthorize("hasRole('A')")
 		void publicCallsPrivate() {
 			privateMethod();
 		}
  • core/src/main/java/org/springframework/security/core/annotation/UniqueSecurityAnnotationScanner.java+2 −2 modified
    @@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -267,7 +267,7 @@ private List<MergedAnnotation<A>> findDirectAnnotations(AnnotatedElement element
 
 	private static Method findMethod(Method method, Class<?> targetClass) {
 		for (Method candidate : targetClass.getDeclaredMethods()) {
-			if (candidate == method) {
+			if (candidate.equals(method)) {
 				return candidate;
 			}
 			if (isOverride(method, candidate)) {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.