Authorization Bypass in Spring Security Aspects for Private Methods by Spring

CVE-2025-41232

What is CVE-2025-41232?

A vulnerability in Spring Security Aspects allows unauthorized access to private methods that have security annotations. When using @EnableMethodSecurity(mode=ASPECTJ) with spring-security-aspects, if a private method annotated with Spring Security method annotations is invoked, it may bypass intended authorization checks. Applications are at risk only if both conditions are met: the use of @EnableMethodSecurity(mode=ASPECTJ) and annotated private methods. To mitigate this risk, ensure that either the @EnableMethodSecurity is not utilized in the specified mode, or no security annotations are present on private methods.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References