Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-bxeh-gaxy-6uch

Summary Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

Aliases

alias	CVE-2026-22746

alias	GHSA-vxf7-qj7q-83fh

Fixed_packages

url	pkg:maven/org.springframework.security/spring-security-core@6.5.10
purl	pkg:maven/org.springframework.security/spring-security-core@6.5.10
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@6.5.10

url	pkg:maven/org.springframework.security/spring-security-core@7.0.5
purl	pkg:maven/org.springframework.security/spring-security-core@7.0.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@7.0.5

Affected_packages

url pkg:maven/org.springframework.security/spring-security-core@5.7.0

purl pkg:maven/org.springframework.security/spring-security-core@5.7.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-8dx4-u4aa-xuet

vulnerability	VCID-9tg6-2h2y-abah

vulnerability	VCID-bxeh-gaxy-6uch

vulnerability	VCID-dwcq-d6nf-1ubn

vulnerability	VCID-r15d-pzfc-3fg7

vulnerability	VCID-u6vb-w2bu-ykfk

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@5.7.0

url pkg:maven/org.springframework.security/spring-security-core@5.7.22

purl pkg:maven/org.springframework.security/spring-security-core@5.7.22

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-bxeh-gaxy-6uch

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@5.7.22

url pkg:maven/org.springframework.security/spring-security-core@5.8.0

purl pkg:maven/org.springframework.security/spring-security-core@5.8.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ceg-a9bh-fkau

vulnerability	VCID-8dx4-u4aa-xuet

vulnerability	VCID-9tg6-2h2y-abah

vulnerability	VCID-bxeh-gaxy-6uch

vulnerability	VCID-dwcq-d6nf-1ubn

vulnerability	VCID-u6vb-w2bu-ykfk

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@5.8.0

url pkg:maven/org.springframework.security/spring-security-core@5.8.24

purl pkg:maven/org.springframework.security/spring-security-core@5.8.24

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-bxeh-gaxy-6uch

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@5.8.24

url pkg:maven/org.springframework.security/spring-security-core@6.3.0

purl pkg:maven/org.springframework.security/spring-security-core@6.3.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1mut-63gq-cbcc

vulnerability	VCID-bxeh-gaxy-6uch

vulnerability	VCID-u6vb-w2bu-ykfk

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@6.3.0

url pkg:maven/org.springframework.security/spring-security-core@6.3.15

purl pkg:maven/org.springframework.security/spring-security-core@6.3.15

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-bxeh-gaxy-6uch

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@6.3.15

url pkg:maven/org.springframework.security/spring-security-core@6.4.0

purl pkg:maven/org.springframework.security/spring-security-core@6.4.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-9np9-s26y-87ch

vulnerability	VCID-b5bu-1gpr-5bbc

vulnerability	VCID-bxeh-gaxy-6uch

vulnerability	VCID-n8yk-aw4d-7qda

vulnerability	VCID-tyxn-hxfu-p3a6

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@6.4.0

url pkg:maven/org.springframework.security/spring-security-core@6.4.15

purl pkg:maven/org.springframework.security/spring-security-core@6.4.15

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-bxeh-gaxy-6uch

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@6.4.15

url pkg:maven/org.springframework.security/spring-security-core@6.5.0

purl pkg:maven/org.springframework.security/spring-security-core@6.5.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-9np9-s26y-87ch

vulnerability	VCID-b5bu-1gpr-5bbc

vulnerability	VCID-bxeh-gaxy-6uch

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@6.5.0

url pkg:maven/org.springframework.security/spring-security-core@6.5.9

purl pkg:maven/org.springframework.security/spring-security-core@6.5.9

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-bxeh-gaxy-6uch

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@6.5.9

url pkg:maven/org.springframework.security/spring-security-core@7.0.0

purl pkg:maven/org.springframework.security/spring-security-core@7.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-bxeh-gaxy-6uch

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@7.0.0

url pkg:maven/org.springframework.security/spring-security-core@7.0.4

purl pkg:maven/org.springframework.security/spring-security-core@7.0.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-bxeh-gaxy-6uch

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@7.0.4

References

reference_url

https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22746.json

reference_id

reference_type

scores

value	3.7
scoring_system	cvssv3
scoring_elements	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

url

https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22746.json

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2026-22746

reference_id

reference_type

scores

value	0.00037
scoring_system	epss
scoring_elements	0.10995
published_at	2026-04-24T12:55:00Z

value	0.00045
scoring_system	epss
scoring_elements	0.13808
published_at	2026-04-26T12:55:00Z

value	0.00054
scoring_system	epss
scoring_elements	0.16712
published_at	2026-05-07T12:55:00Z

value	0.00054
scoring_system	epss
scoring_elements	0.16726
published_at	2026-04-29T12:55:00Z

value	0.00054
scoring_system	epss
scoring_elements	0.16594
published_at	2026-05-05T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2026-22746

reference_url

https://github.com/spring-projects/spring-security

reference_id

reference_type

scores

value	3.7
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

value	LOW
scoring_system	generic_textual
scoring_elements

url

https://github.com/spring-projects/spring-security

reference_url	https://bugzilla.redhat.com/show_bug.cgi?id=2460485
reference_id	2460485
reference_type
scores
url	https://bugzilla.redhat.com/show_bug.cgi?id=2460485

reference_url

https://spring.io/security/cve-2026-22746

reference_id

cve-2026-22746

reference_type

scores

value	3.7
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

value	LOW
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-22T13:36:35Z/

url

https://spring.io/security/cve-2026-22746

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2026-22746

reference_id

CVE-2026-22746

reference_type

scores

value	3.7
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

value	LOW
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2026-22746

reference_url

https://github.com/advisories/GHSA-vxf7-qj7q-83fh

reference_id

GHSA-vxf7-qj7q-83fh

reference_type

scores

value	LOW
scoring_system	cvssv3.1_qr
scoring_elements

url

https://github.com/advisories/GHSA-vxf7-qj7q-83fh

Weaknesses

cwe_id	208
name	Observable Timing Discrepancy
description	Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Exploits

Severity_range_score 0.1 - 3.7

Exploitability 0.5

Weighted_severity 3.3

Risk_score 1.6

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bxeh-gaxy-6uch

Vulnerability Instance