ZeroDay Findings
Sign inSign up

Findings

CVE-2026-22754

Vulnerability in Spring Spring Security.

Published Apr 22, 2026 · updated Jul 15, 2026 · vmware spring security

Vulnerability in Spring Spring Security. If an application uses to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 22, 2026 · NIST NVD

    Detected

    Vulnerability in Spring Spring Security. If an application uses to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.

  2. Jul 15, 2026 · NIST NVD

    Updated

    Vulnerability in Spring Spring Security. If an application uses to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.

Affected

  • cpe vmware/spring securityversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-22754

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-22754

    Vulnerability in Spring Spring Security. If an application uses to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exer

    nvd.nist.gov

References