The vulnerability stems from a flaw in Spring Security’s request matching logic. When an application uses the securityMatchers(String) method together with a PathPatternRequestMatcher.Builder that prepends a servlet path, the resulting request paths can fail to match the intended security filter chain. Consequently, the authentication, authorization, and other security checks that belong to that chain are not executed. An attacker can exploit this mis‑matching to send requests that bypass authentication or authorization checks, gaining unauthorized access to protected resources. The weakness is one of improper authentication and authorization due to a logic error in request path resolution.

Spring Security versions 7.0.0 through 7.0.4 are affected. The flaw lies in the Spring:Spring Security library. Applications that configure securityMatchers and prepend servlet paths via a PathPatternRequestMatcher.Builder are at risk. No other vendors or products are listed.

The CVSS base score of 7.5 indicates high impact severity. EPSS data is not available, so the current likelihood of exploitation cannot be quantified, and the issue is not listed in CISA’s KEV catalog. The attack is likely remote, where an attacker can target the application over the network with crafted requests that exploit the mis‑matched paths. The flaw does not require elevated privileges or code execution; it simply allows bypass of authentication and authorization controls. While no public exploit has been reported, the combination of broad version impact and high severity suggests that patching should occur promptly.