The vulnerability occurs when a Spring Boot application that is servlet‑based, uses the default web security filter chain without any custom Spring Security configuration, includes spring‑boot‑actuator‑autoconfigure, but does not depend on spring‑boot‑health. Under these circumstances the default security is ineffective, allowing an unauthenticated user to reach every endpoint of the application. This missing authorization flaw (CWE‑862) and the insecure default configuration (CWE‑305) can expose or modify sensitive data and services, making the application vulnerable to unauthorized exploitation.

Spring Boot versions 4.0.0 through 4.0.5 are vulnerable if the application meets the above conditions. Updating to 4.0.6 or later addresses the issue.

The CVSS score of 9.1 indicates critical severity. The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is exploiting the default filter chain by sending HTTP requests to any endpoint without authentication, which is feasible for an attacker who can reach the application over the network.