AIKIDO-2025-10171

spring-security-crypto is vulnerable to Improper Authentication

Improper AuthenticationCVE-2025-22228

High Risk

This Affects:

spring-security-crypto

0.0.0 - 5.7.15

Fixed in 5.7.16

5.8.0 - 5.8.17

Fixed in 5.8.18

6.0.0 - 6.0.15

Fixed in 6.0.16

6.1.0 - 6.1.13

Fixed in 6.1.14

6.2.0 - 6.2.9

Fixed in 6.2.10

6.3.0 - 6.3.7

Fixed in 6.3.8

6.4.0 - 6.4.3

Fixed in 6.4.4

TL;DR

Affected versions of this package are vulnerable to improper password verification in BCryptPasswordEncoder.matches(CharSequence, String). When a password exceeds 72 characters, only the first 72 characters are considered for comparison. As a result, passwords that share the same initial 72 characters will incorrectly be treated as identical, potentially allowing authentication bypass.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

spring-security-crypto is vulnerable to Improper Authentication in versions 0.0.0 - 5.7.15, 5.8.0 - 5.8.17, 6.0.0 - 6.0.15, 6.1.0 - 6.1.13, 6.2.0 - 6.2.9, 6.3.0 - 6.3.7 and 6.4.0 - 6.4.3.