CVE-2026-22746

What it actually does

Bypasses DaoAuthenticationProvider timing attack defenses when UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked flags are used, allowing timing side-channel leakage of disabled/expired/locked account status.

Why it matters to the business

Low-risk information disclosure that may assist attackers in account enumeration; stable low EPSS, no KEV listing, and 184 days since publication indicate limited operational urgency across Spring Security deployments.

How an attack unfolds

An attacker performs repeated authentication attempts against known usernames and measures subtle response time differences to infer whether accounts are disabled, expired, or locked, bypassing the intended constant-time checks.

How to fix it

Upgrade Spring Security to versions beyond the affected ranges (5.7.23+, 5.8.25+, 6.3.16+, 6.5.10+, 7.0.5+); review custom UserDetails implementations that rely on the three status methods.

How to confirm the fix worked

Confirm deployed Spring Security version is outside listed ranges; re-execute controlled timing tests with disabled/expired/locked accounts to verify constant-time behavior is restored.

Typical attack path

1. Map target usernames via public sources or prior reconnaissance
2. Issue authentication requests exercising the affected UserDetails status checks
3. Collect high-resolution timing measurements across multiple attempts
4. Statistically distinguish enabled versus disabled/expired/locked accounts

How to detect it

Examine authentication logs for high volumes of failed login attempts against the same usernames with consistent timing patterns; no specific post-exploitation artifacts are typically left.

What your security team should do

• Prioritize upgrade of all Spring Security instances to fixed releases
• Audit applications using custom UserDetails status flags for exposure
• Monitor EPSS and threat intelligence for any future increase in exploitation