Platform
java
Component
spring-security
Fixed in
5.7.23
5.8.25
6.3.16
6.4.16
6.5.10
7.0.5
CVE-2026-22746 is a security vulnerability affecting Spring Security, specifically related to timing attacks when using user attribute checks (isEnabled, isAccountNonExpired, isAccountNonLocked). An attacker can bypass the timing attack defense mechanism designed to protect against credential stuffing and brute-force attacks for users who are disabled, expired, or locked. This vulnerability impacts versions 5.7.0 through 7.0.4 and requires immediate attention to prevent unauthorized access.
The primary impact of CVE-2026-22746 is the potential for unauthorized access to user accounts. Attackers can exploit this vulnerability to bypass the timing attack defense mechanism, allowing them to more easily guess valid credentials for disabled, expired, or locked accounts. This bypass significantly reduces the effectiveness of security measures intended to mitigate credential stuffing and brute-force attacks. While the CVSS score is LOW, the potential for widespread credential stuffing attacks targeting applications using Spring Security makes this a significant concern. The vulnerability's impact is amplified in environments where user accounts are frequently disabled, expired, or locked as part of security policies.
CVE-2026-22746 was publicly disclosed on April 22, 2026. While no public proof-of-concept (PoC) has been released, the nature of the vulnerability – a timing attack bypass – makes it likely that PoCs will emerge. The vulnerability is not currently listed on the CISA KEV catalog. Given the widespread use of Spring Security and the relatively straightforward nature of timing attacks, there is a moderate probability of exploitation.
Exploit Status
EPSS
0.05% (17% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-22746 is to upgrade to a patched version of Spring Security. Versions 5.7.23+, 5.8.25+, 6.3.16+, 6.5.10+, and 7.0.5+ address this vulnerability. If upgrading immediately is not feasible, consider implementing stricter authentication logic to avoid relying solely on the vulnerable user attribute checks. This could involve implementing multi-factor authentication (MFA) or other stronger authentication methods. Review and harden authentication policies to minimize the reliance on these attributes. Monitor authentication logs for suspicious activity, particularly failed login attempts targeting disabled or locked accounts.
Update Spring Security to version 5.7.23 or later, 5.8.25 or later, 6.3.16 or later, 6.4.16 or later, 6.5.10 or later, or 7.0.5 or later. This update corrects a timing attack vulnerability that allows bypassing DaoAuthenticationProvider defenses when user attributes such as isEnabled, isAccountNonExpired, or isAccountNonLocked are used.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-22746 is a LOW severity vulnerability in Spring Security allowing attackers to bypass timing attack defenses for disabled, expired, or locked user accounts, potentially leading to unauthorized access.
You are affected if your application uses Spring Security versions 5.7.0–7.0.4 and relies on isEnabled, isAccountNonExpired, or isAccountNonLocked attributes for authentication.
Upgrade to a patched version of Spring Security: 5.7.23+, 5.8.25+, 6.3.16+, 6.5.10+, or 7.0.5+.
While no active exploitation has been confirmed, the vulnerability's nature makes it likely that exploitation attempts may occur.
Refer to the Spring Security project's official security advisories for detailed information and updates: [https://security.spring.io/](https://security.spring.io/)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your pom.xml file and we'll tell you instantly if you're affected.