← Back

CVE-2026-22746

nvd nist
Published: Apr 22, 2026Modified: Jun 17, 2026

JSON object

Loading...
3.7
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.2 / Impact: 1.4
Source: security@vmware.com (Secondary)

Description

Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

Affected (6)

Vmware
1 product
Spring Security
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Security
Before 5.7.23
Spring Security
From 5.8.0 to 5.8.25
Spring Security
From 6.3.0 to 6.3.16
Spring Security
From 6.4.0 to 6.4.16
Spring Security
From 6.5.0 to 6.5.10
Spring Security
From 7.0.0 to 7.0.5

Related CWEs

CWE-208
Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.