Skip to content
OpenAdvisories
Critical · 9.1 Public exploit CVE-2023-34034 EUVD-2023-1939GHSA-3h6f-g5f3-gc4w

Access Control Bypass in Spring Security

Published Jul 19, 2023 · Updated May 1, 2026 · Assigned by vmware

Package: org.springframework.security:spring-security-config Ecosystem: Maven

Description

Using "**" as a pattern in Spring Security configuration
for WebFlux creates a mismatch in pattern matching between Spring
Security and Spring WebFlux, and the potential for a security bypass.

Affected products

VendorProductAffectedFixed
— Spring Security Spring Security 6.1.0 – ≤ 6.1.1, Spring Security 6.0.0 – ≤ 6.0.4, Spring Security 5.8.0 – ≤ 5.8.4, Spring Security 5.7.0 – ≤ 5.7.9 , Spring Security 5.6.0 – ≤ 5.6.11 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • hotblac/cve-2023-34034 ★ 1 · Dec 2, 2023

    Demonstration of CVE-2023-24034 authorization bypass in Spring Security

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.springframework.security:spring-security-config >= 5.6.0, < 5.6.12 5.6.12 GHSA-3h6f-g5f3-gc4w
Maven org.springframework.security:spring-security-config >= 5.7.0, < 5.7.10 5.7.10 GHSA-3h6f-g5f3-gc4w
Maven org.springframework.security:spring-security-config >= 5.8.0, < 5.8.5 5.8.5 GHSA-3h6f-g5f3-gc4w
Maven org.springframework.security:spring-security-config >= 6.0.0, < 6.0.5 6.0.5 GHSA-3h6f-g5f3-gc4w
Maven org.springframework.security:spring-security-config >= 6.1.0, < 6.1.2 6.1.2 GHSA-3h6f-g5f3-gc4w

Advisories 11

References