Spring Security Vulnerável à Enumeração de Atributos de Usuário ao Usar DaoAuthenticationProvider

The primary impact of CVE-2026-22746 is the potential for unauthorized access to user accounts. Attackers can exploit this vulnerability to bypass the timing attack defense mechanism, allowing them to more easily guess valid credentials for disabled, expired, or locked accounts. This bypass significantly reduces the effectiveness of security measures intended to mitigate credential stuffing and brute-force attacks. While the CVSS score is LOW, the potential for widespread credential stuffing attacks targeting applications using Spring Security makes this a significant concern. The vulnerability's impact is amplified in environments where user accounts are frequently disabled, expired, or locked as part of security policies.

Applications using Spring Security versions 5.7.0–7.0.4 that rely on the UserDetails#isEnabled, UserDetails#isAccountNonExpired, or UserDetails#isAccountNonLocked attributes for authentication are at risk. This includes applications with robust account lifecycle management policies that frequently disable, expire, or lock user accounts. Shared hosting environments utilizing Spring Security are also particularly vulnerable due to the potential for cross-tenant attacks.

• java / server: Monitor application logs for unusual authentication patterns, particularly failed login attempts targeting disabled or locked accounts. Use a security information and event management (SIEM) system to correlate authentication events with other security indicators. • generic web: Examine web server access logs for repeated login attempts from the same IP address targeting user accounts with specific attributes (disabled, expired, locked). Look for patterns indicative of credential stuffing.

grep 'authentication failure' /var/log/apache2/error.log | grep 'disabled|expired|locked'

1. 2026-04-22Disclosure

   disclosure

1. Reservado2026-01-09
2. Publicada2026-04-22
3. EPSS atualizado2026-04-29

The primary mitigation for CVE-2026-22746 is to upgrade to a patched version of Spring Security. Versions 5.7.23+, 5.8.25+, 6.3.16+, 6.5.10+, and 7.0.5+ address this vulnerability. If upgrading immediately is not feasible, consider implementing stricter authentication logic to avoid relying solely on the vulnerable user attribute checks. This could involve implementing multi-factor authentication (MFA) or other stronger authentication methods. Review and harden authentication policies to minimize the reliance on these attributes. Monitor authentication logs for suspicious activity, particularly failed login attempts targeting disabled or locked accounts.