Spring Boot Default Web Security Vulnerability Allowing Unauthorized Access

A vulnerability exists in Spring Boot versions 4.0.0 through 4.0.5, where the default web security is ineffective, allowing unauthorized access to all endpoints. This issue arises in servlet-based web applications that lack their own Spring Security configuration and instead rely on the default web security filter chain. The vulnerability is present in applications that depend on spring-boot-actuator-autoconfigure but do not use spring-boot-health.

Impact

Exploitation of this vulnerability could lead to unauthorized access to all endpoints of the affected application.

Remediation

Users should upgrade to Spring Boot version 4.0.6 or later.