The flaw arises when Spring Security’s request matching logic fails to include the servlet path when securityMatchers(String) is used together with a PathPatternRequestMatcher.Builder, causing intended security filter chains to be ignored. As a result, authentication, authorization, and other security checks are not executed for certain requests. This represents weaknesses in Incorrect URL Mapping (CWE‑551) and Security Misconfiguration (CWE‑693).

Spring Security versions 7.0.0 through 7.0.4 are affected. Any application that configures securityMatchers and prepends a servlet path using a PathPatternRequestMatcher.Builder while running one of those versions is at risk. No other vendors or products are listed.

The CVSS score of 7.5 signals high impact severity, while the EPSS score of < 1% indicates a very low but non‑zero likelihood that the vulnerability will be actively exploited. It is not yet listed in CISA’s KEV catalog. The likely attack vector is remote HTTP requests; based on the description, it is inferred that an attacker can craft requests that bypass authentication or authorization checks by taking advantage of the mis‑matched paths. The flaw does not require code execution or elevated privileges and would simply allow unauthorized access to protected resources if not mitigated.