A critical authorization bypass vulnerability in the Spring Framework allows unauthenticated remote attackers to circumvent security predicates, posing a significant risk to application integrity.

The vulnerability is an incorrect authorization flaw (CWE-863) where an unauthenticated attacker can bypass header-based security predicates during pre-flight requests in WebFlux applications deployed with DispatcherServlet.

Successful exploitation of this vulnerability permits unauthorized access to functional endpoints, potentially leading to full compromise of application data, unauthorized configuration changes, or denial of service. Given the CVSS score of 9.8, this flaw represents a critical risk to business operations, as it is network-exploitable without requiring authentication or user interaction.

Immediate Action: Review the official Spring security advisory for specific patch versions and apply the necessary updates to your Spring Framework dependencies as soon as they are made available.

Proactive Monitoring: Inspect application access logs for anomalous pre-flight request patterns or unauthorized attempts to access protected functional endpoints that bypass expected header requirements.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to filter and validate incoming pre-flight requests, ensuring that required headers are present and correctly formatted before they reach the application.

Public Exploit Available: No (exploit_available: unknown)

Due to the critical nature of this vulnerability and its potential for unauthenticated remote exploitation, organizations using the affected versions of the Spring Framework must prioritize this issue. Closely monitor the official Spring project channels for the release of patched versions and prepare to deploy them across all affected environments immediately upon availability to prevent potential exploitation.