Description

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.

More precisely, an application can be vulnerable when all the following are true:

• the application has the Actuator dependency on the classpath
• the application declares a custom health group (here "mygroup"), with management.endpoint.health.group.mygroup.include
• this health group is exposed under an additional path on the main server, like management.endpoint.health.group.mygroup.additional-path=server:/healthz
• the application contributes an application endpoint that requires authentication under a subpath, like "/healthz/admin"

Note that mapping application endpoints under infrastructure endpoints like Actuators is not recommended by the Spring team and that doing so is likely to interfere with other configurations and cause behavior problems. While the severity for this advisory is high, we expect this setup to rarely occur in production.

This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

Affected Spring Products and Versions

Spring Boot:

• 4.0.0 - 4.0.3
• 3.5.0 - 3.5.11
• 3.4.0 - 3.4.14

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

Credit

This issue was responsibly reported by Gyu-hyeok Lee (g2h).

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N&version=3.1

History

• 2026-03-19: Initial vulnerability report published.