← Back

CVE-2026-22733

nvd nist
Published: Mar 20, 2026Modified: Jun 17, 2026

JSON object

Loading...
8.1
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.2 / Impact: 5.9
Source: NVD

Description

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.

Affected (5)

Products: Vmware: Spring Boot
Vmware
1 product
Spring Boot
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Boot
Before 2.7.32
Spring Boot
From 3.3.0 to 3.3.18
Spring Boot
From 3.4.0 to 3.4.15
Spring Boot
From 3.5.0 to 3.5.12
Spring Boot
From 4.0.0 to 4.0.4

Related CWEs

CWE-288
Authentication Bypass Using an Alternate Path or Channel
A product requires authentication, but the product has an alternate path or channel that does not require authentication.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.