Auth bypass in VMware Spring Framework
CVE-2025-41249
The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions. Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces. This CVE is published in conjunction with CVE-2025-41248 https://spring.io/security/cve-2025-41248 .
EPSS: 0.005 (38.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Vmware Spring Framework — versions 6.2.x, 6.1.x, 5.3.x
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-41249?
- CVE-2025-41249 is a high-severity vulnerability in VMware Spring Framework, classified under Improper Authorization. CVSS score: 7.5/10. Published 2025-09-16.
- How severe is CVE-2025-41249?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2025-41249 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.