AesBytesEncryptor uses a null (all‑zero) initialization vector when constructed with two arguments or when the IV generator is null, causing the AES/CBC encryption to be deterministic. This determinism enables an adversary to correlate ciphertext blocks and infer information about the plaintext without the key.

Spring Security versions from 5.7.0 through 7.1.0 are affected, including the 5.7.x, 5.8.x, 6.4.x, 6.5.x, 7.0.x and the 7.1.0 release.

The CVSS score of 6.5 indicates a moderate risk. The EPSS score is less than 1 %, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the use of a hard‑coded or null IV in applications that employ AesBytesEncryptor, allowing an attacker who can observe the encrypted output to perform ciphertext‑correlation attacks and reduce uncertainty about the underlying plaintext. No remote code execution is possible, but the confidentiality of sensitive data is compromised.