Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. An attacker capable of submitting a very large number of guesses and precisely measuring response latency could, in principle, use these timing differences to recover the expected value one character at a time.

The affected comparisons are:

• DigestAuthenticationFilter, when validating the client-supplied Digest authentication response and nonce signature.
• KeyBasedPersistenceTokenService, when verifying a token's key.
• BalloonHashingPassword4jPasswordEncoder and Pbkdf2Password4jPasswordEncoder, when verifying a raw password against its stored hash.
• InMemoryOAuth2AuthorizationService, when locating an authorization by its state, authorization code, access token, refresh token, ID token, device code, or user code.

An application is potentially affected when it:

• Uses DigestAuthenticationFilter for HTTP Digest authentication (a legacy authentication mechanism).
• Uses KeyBasedPersistenceTokenService, a class that is not wired by any Spring Security component by default.
• Uses BalloonHashingPassword4jPasswordEncoder or Pbkdf2Password4jPasswordEncoder to verify passwords.
• Uses the default, in-memory InMemoryOAuth2AuthorizationService in an OAuth2 authorization server and permits an attacker to repeatedly probe token-related endpoints.

Successfully exploiting any of these timing differences to recover a secret value would require an attacker to submit an extremely large number of requests with low network jitter and precise timing measurement, which is difficult to achieve reliably over a typical network. Where exploitable, a successful attack could allow an attacker to recover a password hash, authentication digest, verification key, or OAuth2 token value without otherwise knowing it, potentially resulting in impersonation or unauthorized access.