A critical security bypass vulnerability in Spring Security versions 7.0.0 through 7.0.4 allows unauthenticated attackers to circumvent security controls, potentially leading to unauthorized access.

The flaw arises when using securityMatchers(String) alongside a PathPatternRequestMatcher.Builder bean to prepend a servlet path. This configuration causes the security filter chain to fail, which renders authentication and authorization controls inactive for affected requests.

This vulnerability poses a significant risk to organizational security, as it allows attackers to bypass intended authentication and authorization mechanisms. Given the CVSS score of 7.5, which indicates High severity, the potential for unauthorized access to protected resources or sensitive data is substantial. Failure to remediate this issue could result in a complete compromise of the application security posture, leading to data exfiltration or unauthorized administrative actions.

Immediate Action: Update the affected Spring Security dependency to version 7.0.5 or later via your Maven or Gradle build configuration.

Proactive Monitoring: Review application access logs for unusual patterns, specifically focusing on requests that bypass expected security filters or authentication redirects.

Compensating Controls: Deploy or tune a Web Application Firewall (WAF) to inspect incoming traffic for patterns that attempt to exploit path-based request matching, though an application-level patch remains the only definitive fix.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with the ease of exploitation, necessitates immediate attention from development and security teams. Organizations utilizing Spring Security versions 7.0.0 through 7.0.4 must prioritize upgrading to version 7.0.5 to restore critical security protections. Applying this patch is the only effective way to prevent potential unauthorized access resulting from this misconfiguration.