Spring WebFlux applications may be vulnerable when using the Kotlin Router DSL. The flaw allows an attacker to bypass the framework's security filters, potentially gaining unauthorized access to protected routes or data. This is an Improper Authorization weakness (CWE‑284; NVD-CWE-noinfo) that could expose confidential information or enable further exploitation.

The affected product is the Spring Framework from the Spring vendor. Versions 5.3.0 through 5.3.48 are impacted. Any applications built with these releases that employ the Kotlin Router DSL in a WebFlux context are potentially vulnerable.

The CVSS score of 4.8 indicates a moderate severity, but the EPSS score of 0.00027 (below 1%) and the vulnerability not being listed in the CISA KEV catalog suggest limited known exploitation. Because the description does not reveal a specific attack vector, the likely exploitation would involve sending crafted HTTP requests to endpoints configured via Kotlin Router DSL, exploiting the missing security filter enforcement. No public exploit or patch is currently available from the CNA, so organizations should treat this as a moderate risk until they upgrade or remediate.