What is the CVSS score of CVE-2026-22746?

CVE-2026-22746 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-22746?

Yes, a patch is available for CVE-2026-22746. Update the affected software to the latest version immediately.

Spring Security CVE-2026-22746

EUVD-2026-24607 LOW

Observable Timing Discrepancy (CWE-208)

2026-04-22 vmware

GHSA-vxf7-qj7q-83fh

Authentication Bypass Java

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 06:30 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 06:00 euvd

EUVD-2026-24607

Analysis Generated

Apr 22, 2026 - 06:00 vuln.today

CVE Published

Apr 22, 2026 - 05:02 nvd

LOW 3.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

37 maven packages depend on org.springframework.security:spring-security-core (20 direct, 17 indirect)

Ecosystem-wide dependent count for version 5.7.0.

DescriptionCVE.org

Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

AnalysisAI

Spring Security's DaoAuthenticationProvider can leak timing information about user account status when applications rely on UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked attributes for user validation. This allows remote attackers to enumerate disabled, expired, or locked accounts through timing analysis of authentication responses across affected versions 5.7.0-5.7.22, 5.8.0-5.8.24, 6.3.0-6.3.15, 6.5.0-6.5.9, and 7.0.0-7.0.4. No public exploit code or active exploitation has been identified at this time.

Technical ContextAI

Spring Security's DaoAuthenticationProvider is the core component that authenticates users by retrieving UserDetails from a data access object (DAO) and validating credentials and account status flags. The vulnerability stems from a timing side-channel in the authentication validation logic where account status checks (enabled, account non-expired, account non-locked) complete at different speeds depending on whether the user exists and their account state, rather than executing constant-time validation. This bypasses the timing attack defense mechanism intended to prevent attackers from distinguishing valid usernames from invalid ones. The flaw affects Java applications using Spring Security versions across multiple release branches (5.7.x, 5.8.x, 6.3.x, 6.5.x, 7.0.x).

RemediationAI

Upgrade Spring Security to patched versions: 5.7.23 or later for 5.7.x branch, 5.8.25 or later for 5.8.x branch, 6.3.16 or later for 6.3.x branch, 6.5.10 or later for 6.5.x branch, or 7.0.5 or later for 7.0.x branch. Patched releases restore constant-time validation for account status checks, eliminating the timing side-channel. Apply patches via Maven Central Repository or Spring's artifact repository. For applications unable to upgrade immediately, implement network-level mitigations: rate-limit authentication attempts per source IP (e.g., 5 failed attempts per minute) to increase statistical noise in timing measurements and reduce attacker's ability to accumulate precise timing data; deploy a WAF (Web Application Firewall) configured to throttle rapid authentication requests. Note that rate-limiting may degrade user experience for legitimate users with network issues. Test patches in non-production environments first to ensure compatibility with custom authentication logic. Verify that UserDetails implementations are not overridden with non-constant-time account status validation.