Spring Security components use standard string equality for comparing sensitive values, which returns after detecting the first non‑matching character. This means the rejection time correlates with the number of matching leading characters. An attacker could measure response times to infer the correct value character by character, leaking credentials or tokens and enabling unauthorized access.

The flaw exists in Spring Security for the following versions: 5.7.0 through 5.7.25, 5.8.0 through 5.8.27, 6.4.0 through 6.4.18, 6.5.0 through 6.5.11, 7.0.0 through 7.0.6, and 7.1.0. All deployments using these releases are vulnerable.

The CVSS score of 5.9 indicates medium severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of exploitation is unknown. The attack is likely performed remotely via authentication or token validation endpoints that compare user supplied values, requiring the attacker to observe response timing for each request. While each request yields partial information, repeated trials can recover the entire sensitive value.