Spring Framework and Security Vulnerabilities Enables Authorization Bypass and Annotation Detection Flaw
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Two critical vulnerabilities, CVE-2025-41248 and CVE-2025-41249, have emerged in Spring Security and Spring Framework that could allow attackers to bypass authorization controls in enterprise applications.\u00a0<\/p>\n
These flaws arise when using Spring Security\u2019s @EnableMethodSecurity feature in conjunction with method-level annotations such as @PreAuthorize and @PostAuthorize.\u00a0<\/p>\n
In applications where service interfaces or abstract base classes employ unbounded generics, the annotation detection mechanism may fail to locate security annotations on overridden methods, enabling unauthorized access to protected endpoints.\u00a0<\/p>\n
Key Takeaways<\/mark><\/strong>
1. Spring Security 6.4.x\/6.5.x ignores method-level annotations, enabling bypass.
2. Spring Framework 5.3.x\/6.1.x\/6.2.x fails to detect annotations.
3. Upgrade to fixed versions or redeclare annotations on concrete classes.<\/pre>\nBoth the authorization bypass<\/a> and annotation detection flaws are classified as Medium severity and impact a wide range of Spring Security and Spring Framework versions spanning the 5.x through 6.x release trains.<\/p>\n
Authorization Bypass Vulnerability (CVE-2025-41248)<\/strong><\/h2>\n
CVE-2025-41248 targets Spring Security versions 6.4.0 through 6.4.9 and 6.5.0 through 6.5.3.\u00a0<\/p>\n
When a parameterized superclass defines a secured method signature, and a subclass fails to redeclare the relevant annotation, the framework\u2019s metadata resolver does not traverse the generic type hierarchy correctly.\u00a0<\/p>\n
Attackers may exploit this logic gap by invoking secured operations defined only on a generic interface, bypassing authorization checks that rely on @PreAuthorize(\u201chasRole(\u2018ADMIN\u2019)\u201d) or similar SpEL expressions.\u00a0<\/p>\n
The vulnerability yields<\/a> a CVSS 3.1 base score of 6.5 (AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N).<\/p>\n
Annotation Detection Vulnerability (CVE-2025-41249)<\/strong><\/h2>\n
CVE-2025-41249 affects Spring Framework core modules in versions 5.3.0 through 5.3.44, 6.1.0 through 6.1.22, and 6.2.0 through 6.2.10.\u00a0<\/p>\n
In this case, the annotation detection flaw impedes recognition of any method annotation used for authorization or auditing when defined on a generic base class.\u00a0<\/p>\n
Without the annotation metadata, Spring Security cannot enforce method-level security constraints.<\/p>\n
Both vulnerabilities stem from<\/a> improper handling of unbounded generics during annotation introspection, causing the runtime to ignore security metadata and treat sensitive service methods as if they were unprotected.<\/p>\n
\n