Spring Framework Security Flaws Allow Authorization Bypass and Annotation Detection Issues

A pair of medium-severity vulnerabilities in Spring Framework and Spring Security were disclosed on 15 September 2025, affecting the annotation detection mechanism used by Spring Security’s method security features and potentially enabling authorization bypass in applications that rely on parameterised types or unbounded generic superclasses.

The issues are tracked as CVE-2025-41248 and CVE-2025-41249, with CVE-2025-41248 affecting Spring Security versions 6.4.0 through 6.4.9 and 6.5.0 through 6.5.3, and CVE-2025-41249 spanning Spring Framework versions 5.3.0 through 5.3.44, 6.1.0 through 6.1.22, and 6.2.0 through 6.2.10, plus older unsupported releases. Attackers could invoke secured methods without proper permission checks by exploiting how inherited annotations are resolved in type hierarchies that use generics.

To address CVE-2025-41248, users are advised to upgrade to Spring Security 6.4.10 or 6.5.4, while CVE-2025-41249 has fixes in Spring Framework 5.3.45, 6.1.23 (commercial), and 6.2.11. If upgrading immediately is not feasible, a workaround is to declare all secured methods directly in the target classes rather than inheriting them from generic superclasses, and development teams should audit codebases for the use of EnableMethodSecurity and method-level annotations on generic types.