Spring Boot applications that use Actuator can be affected by an authentication bypass flaw. When an endpoint that normally requires authentication is placed under a health group path, the security filter that blocks unauthenticated traffic is mistakenly skipped. This flaw was classified as CWE-288, CWE-305, and CWE-306. Unauthenticated users may thereby reach protected diagnostic data, system metrics, and configuration endpoints that are normally restricted, potentially revealing sensitive information and creating a foothold for further attacks.

The flaw applies to Spring Boot releases where Actuator is enabled. Specifically, any Spring Boot 4.0 version before 4.0.3, Spring Boot 3.5 before 3.5.11, or Spring Boot 3.4 before 3.4.15 are vulnerable when an endpoint that requires authentication is declared under a health group additional path. All other product lines of Spring Boot remain unaffected.

The CVSS base score of 8.2 indicates high severity, while the EPSS score is reported as less than 1% and the flaw is not listed in the CISA KEV catalog, suggesting no known active exploitation. Based on the description, an attacker could use an unauthenticated HTTP request to the misconfigured health group endpoint to trigger the bypass. No credentials or privileged access are required, and access to otherwise protected data could compromise confidentiality.