User Attribute Enumeration when Using DaoAuthenticationProvider

LOW | APRIL 20, 2026 | CVE-2026-22746

Description

If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.

Affected Spring Products and Versions

Spring Security:

7.0.0 - 7.0.4
6.5.0 - 6.5.9
6.4.0 - 6.4.15
6.3.0 - 6.3.15
5.8.0 - 5.8.24
5.7.22 and earlier

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Fix version	Availability
7.0.5	OSS
6.5.10	OSS
6.4.16	Enterprise Support Only
6.3.16	Enterprise Support Only
5.8.25	Enterprise Support Only
5.7.23	Enterprise Support Only

Note that this version also introduces a setter DaoAuthenticationProvider#setAlwaysPerformAdditionalChecksOnUser. In the event that this upgrade causes you trouble, you can set this value to false.