CVE-2025-41248
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
16/09/2025
Last modified:
16/09/2025
Description
The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass.<br />
<br />
Your application may be affected by this if you are using Spring Security&#39;s @EnableMethodSecurity feature.<br />
<br />
You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.<br />
<br />
This CVE is published in conjunction with CVE-2025-41249 https://spring.io/security/cve-2025-41249 .
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH