Auth bypass in Spring Boot
CVE-2026-22731
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
EPSS: 0.003 (26.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.
Affected products
- Spring Boot — versions 4.0, 3.5, 3.4
- Vmware Spring_boot
Weakness classification (CWE)
References
- security@vmware.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-22731?
- CVE-2026-22731 is a high-severity vulnerability in Spring Boot, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 8.2/10. Published 2026-03-19.
- How severe is CVE-2026-22731?
- High severity. CVSS v3 base score is 8.2 out of 10.