What is the CVSS score of CVE-2026-22753?

CVE-2026-22753 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring Security are affected by CVE-2026-22753?

Spring Security versions 7.0.0-7.0.4 contain a path matching bypass vulnerability that allows unauthenticated attackers to completely evade authentication and authorization controls on protected…. A patch is available.

How to fix or mitigate CVE-2026-22753?

Within 24 hours: Identify all applications using Spring Security 7.0.0-7.0.4 with securityMatchers(String) and PathPatternRequestMatcher.Builder configurations through dependency scanning and code review. Within 7 days: Monitor CVE advisories and Spring Security release channels for patch availability; implement temporary access controls via WAF rules or network segmentation to restrict unauthorized endpoint access if applications cannot be modified. Within 30 days: Apply vendor-released patch immediately upon availability or downgrade to Spring Security 6.x LTS if patch timeline is unacceptable.

Spring Security CVE-2026-22753

EUVD-2026-24611 HIGH

Protection Mechanism Failure (CWE-693)

2026-04-22 vmware

GHSA-4wrg-8wpc-h923

Information Disclosure Java Red Hat

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 17:22 vuln.today

cvss_changed

Analysis Generated

Apr 22, 2026 - 06:30 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 06:00 euvd

EUVD-2026-24611

Analysis Generated

Apr 22, 2026 - 06:00 vuln.today

CVE Published

Apr 22, 2026 - 05:20 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

142 maven packages depend on org.springframework.security:spring-security-config (21 direct, 121 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionCVE.org

Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the application. This can lead to the authentication, authorization, and other security controls being rendered inactive on intended requests.This issue affects Spring Security: from 7.0.0 through 7.0.4.

AnalysisAI

Path matching bypass in Spring Security 7.0.0-7.0.4 allows unauthenticated remote attackers to evade authentication, authorization, and other security controls when applications use securityMatchers(String) with a PathPatternRequestMatcher.Builder bean to prepend servlet paths. Improper matcher configuration causes filter chains to silently fail, leaving protected endpoints exposed without intended security controls. No active exploitation confirmed, but CVSS 7.5 with network attack vector (AV:N/AC:L/PR:N) indicates readily exploitable if applications use the specific configuration pattern. VMware-reported vulnerability requires immediate patching for affected Spring Security 7.x deployments.

Technical ContextAI

Spring Security's filter chain framework relies on request matchers (securityMatchers) to determine which HTTP requests trigger specific security controls. The PathPatternRequestMatcher.Builder is used to customize path matching behavior, including prepending servlet context paths to match patterns. In versions 7.0.0 through 7.0.4, a logic flaw causes the matcher to fail silently when securityMatchers(String) is combined with a PathPatternRequestMatcher.Builder bean configured to prepend servlet paths. This results in requests that should match the filter chain bypassing it entirely. The integrity impact is rated High (I:H) because security controls like authentication filters, authorization checks, CSRF protection, and session management configured in that filter chain become completely inactive for affected request paths. This is not a traditional authentication bypass vulnerability (no CWE assigned) but rather a framework configuration processing bug that creates unintended security gaps.

RemediationAI

Upgrade to Spring Security version 7.0.5 or later, which resolves the path matching logic flaw. For Maven projects, update dependency version in pom.xml to <version>7.0.5</version> or higher. For Gradle projects, update build.gradle to implementation 'org.springframework.security:spring-security-web:7.0.5+'. Full patching guidance available in the official Spring Security advisory at https://spring.io/security/cve-2026-22753. If immediate upgrade is not feasible, implement temporary workaround by replacing securityMatchers(String) with explicit RequestMatcher instances that do not rely on PathPatternRequestMatcher.Builder servlet path prepending. Specifically, manually construct request matchers with full paths including servlet context rather than relying on builder-based path prepending. Note this workaround requires code changes and testing to ensure all protected paths remain correctly matched. Post-remediation, conduct security audit of application logs and access logs to identify any unauthorized access to previously protected endpoints during the vulnerability window, as the silent failure provides no runtime indication of security control bypass.