Observable discrepancy in Spring Security - CVE-2026-22746
Published: April 27, 2026
Vulnerability identifier: #VU128224
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-22746
CWE-ID: CWE-203
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to observable timing discrepancies in DaoAuthenticationProvider when processing authentication requests for disabled, expired, or locked users. A remote attacker can send authentication attempts for different usernames to disclose sensitive information.
The issue is exposed when applications rely on the UserDetails isEnabled, isAccountNonExpired, or isAccountNonLocked attributes to enable, expire, or lock users.
Affected software
Spring Security
Library Support for Spring
IBM Sterling Connect:Direct Web Services
MongoDB Enterprise Advanced with IBM
Library Support for Spring
IBM Sterling Connect:Direct Web Services
MongoDB Enterprise Advanced with IBM
How to mitigate CVE-2026-22746
Install security update from vendor's website.
Spring Security - addressed in versions 5.7.23, 5.8.25, 6.3.16, 6.4.16, 6.5.10, 7.0.5
Library Support for Spring - update to 3.4.18
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.19, 6.4.0.8
MongoDB Enterprise Advanced with IBM - update to 1.16.0
Library Support for Spring - update to 3.4.18
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.19, 6.4.0.8
MongoDB Enterprise Advanced with IBM - update to 1.16.0