{"id":"GHSA-vxf7-qj7q-83fh","summary":"Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider","details":"Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.","aliases":["CVE-2026-22746"],"modified":"2026-07-17T21:12:55.099236426Z","published":"2026-04-22T06:30:28Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-04-29T20:48:02Z","nvd_published_at":"2026-04-22T06:16:02Z","cwe_ids":["CWE-208"],"severity":"LOW"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22746"},{"type":"PACKAGE","url":"https://github.com/spring-projects/spring-security"},{"type":"WEB","url":"https://spring.io/security/cve-2026-22746"}],"affected":[{"package":{"name":"org.springframework.security:spring-security-core","ecosystem":"Maven","purl":"pkg:maven/org.springframework.security/spring-security-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.0"},{"last_affected":"5.7.22"}]}],"versions":["5.7.0","5.7.1","5.7.10","5.7.11","5.7.12","5.7.13","5.7.14","5.7.2","5.7.3","5.7.4","5.7.5","5.7.6","5.7.7","5.7.8","5.7.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-vxf7-qj7q-83fh/GHSA-vxf7-qj7q-83fh.json"}},{"package":{"name":"org.springframework.security:spring-security-core","ecosystem":"Maven","purl":"pkg:maven/org.springframework.security/spring-security-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.0"},{"last_affected":"5.8.24"}]}],"versions":["5.8.0","5.8.1","5.8.10","5.8.11","5.8.12","5.8.13","5.8.14","5.8.15","5.8.16","5.8.2","5.8.3","5.8.4","5.8.5","5.8.6","5.8.7","5.8.8","5.8.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-vxf7-qj7q-83fh/GHSA-vxf7-qj7q-83fh.json"}},{"package":{"name":"org.springframework.security:spring-security-core","ecosystem":"Maven","purl":"pkg:maven/org.springframework.security/spring-security-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.0"},{"last_affected":"6.3.15"}]}],"versions":["6.3.0","6.3.1","6.3.10","6.3.2","6.3.3","6.3.4","6.3.5","6.3.6","6.3.7","6.3.8","6.3.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-vxf7-qj7q-83fh/GHSA-vxf7-qj7q-83fh.json"}},{"package":{"name":"org.springframework.security:spring-security-core","ecosystem":"Maven","purl":"pkg:maven/org.springframework.security/spring-security-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"last_affected":"6.4.15"}]}],"versions":["6.4.0","6.4.1","6.4.10","6.4.11","6.4.12","6.4.13","6.4.2","6.4.3","6.4.4","6.4.5","6.4.6","6.4.7","6.4.8","6.4.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-vxf7-qj7q-83fh/GHSA-vxf7-qj7q-83fh.json"}},{"package":{"name":"org.springframework.security:spring-security-core","ecosystem":"Maven","purl":"pkg:maven/org.springframework.security/spring-security-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.0"},{"fixed":"6.5.10"}]}],"versions":["6.5.0","6.5.1","6.5.2","6.5.3","6.5.4","6.5.5","6.5.6","6.5.7","6.5.8","6.5.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 6.5.9","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-vxf7-qj7q-83fh/GHSA-vxf7-qj7q-83fh.json"}},{"package":{"name":"org.springframework.security:spring-security-core","ecosystem":"Maven","purl":"pkg:maven/org.springframework.security/spring-security-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.5"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.3","7.0.4"],"database_specific":{"last_known_affected_version_range":"\u003c= 7.0.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-vxf7-qj7q-83fh/GHSA-vxf7-qj7q-83fh.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}