CVE-2026-22746: User Attribute Enumeration when Using DaoAuthenticationProvider
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22746?
CVE-2026-22746 is considered a high severity vulnerability due to its potential for user attribute enumeration.
How do I fix CVE-2026-22746?
To fix CVE-2026-22746, update Spring Security to a version that is not affected, specifically above 5.7.22, 5.8.24, 6.3.15, 6.5.9, or 7.0.4.
What versions of Spring Security are affected by CVE-2026-22746?
CVE-2026-22746 affects Spring Security versions from 5.7.0 to 5.7.22, 5.8.0 to 5.8.24, 6.3.0 to 6.3.15, 6.5.0 to 6.5.9, and 7.0.0 to 7.0.4.
What types of applications are vulnerable to CVE-2026-22746?
Applications using DaoAuthenticationProvider with the methods UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked are vulnerable to CVE-2026-22746.
What is the risk associated with CVE-2026-22746?
The risk associated with CVE-2026-22746 includes potential unauthorized access through user attribute enumeration.