Password Validation Flaw in Spring Framework Affects BCryptPasswordEncoder
CVE-2025-22228
7.4HIGH
Summary
A vulnerability exists in the BCryptPasswordEncoder component of the Spring Framework that can lead to improper password validation. Specifically, the method BCryptPasswordEncoder.matches(CharSequence, String) may incorrectly return true for passwords longer than 72 characters if the first 72 characters match. This flaw could potentially grant unauthorized access, allowing attackers to exploit the weakness in password checks and compromise user accounts.
Affected Version(s)
Spring Security 5.7.x
Spring Security 5.7.x < 5.7.16
Spring Security 5.8.x < 5.8.18
References
CVSS V3.1
Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved