Description

If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.

Affected Spring Products and Versions

Spring Security:

• 5.7.0 - 5.7.22
• 5.8.0 - 5.8.24
• 6.3.0 - 6.3.15
• 6.4.0 - 6.4.15
• 6.5.0 - 6.5.9
• 7.0.0 - 7.0.4
• Older, unsupported versions are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Note that this version also introduces a setter DaoAuthenticationProvider#setAlwaysPerformAdditionalChecksOnUser. In the event that this upgrade causes you trouble, you can set this value to false.

Credit

The issue was identified and responsibly reported by meverden.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N&version=3.1

History

• 2026-04-20: Initial vulnerability report published.