Spring Security Authorization Bypass Vulnerability in Private Methods

A vulnerability exists in Spring Security versions 6.4.0 through 6.4.5, where the Spring Security Aspects may fail to properly identify method security annotations on private methods. This can lead to an authorization bypass, allowing private methods with Spring Security annotations to be invoked without the necessary authorization. The issue arises when using '@EnableMethodSecurity(mode=ASPECTJ)' and 'spring-security-aspects'.

Impact

Exploitation of this vulnerability allows private methods annotated with Spring Security method annotations to be called without proper authorization, potentially leading to unauthorized access or actions within the application.

Remediation

Users of affected Spring Security versions should upgrade to version 6.4.6.