CVE-2026-22746: 
Jenkins vulnerability analysis and mitigation

CVE-2026-22746 is a timing attack bypass vulnerability in Spring Security, classified as "User Attribute Enumeration when Using DaoAuthenticationProvider." When an application uses UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked attributes to manage user account states, the DaoAuthenticationProvider's built-in timing attack defense can be circumvented for disabled, expired, or locked accounts. Affected versions span Spring Security 5.7.0–5.7.22, 5.8.0–5.8.24, 6.3.0–6.3.15, 6.4.0–6.4.15, 6.5.0–6.5.9, and 7.0.0–7.0.4. The vulnerability was initially reported on April 20, 2026, and published to the NVD on April 22, 2026. It carries a CVSS v3.1 base score of 3.7 (Low) (Spring Advisory, GitHub Advisory).

The root cause is classified as CWE-208 (Observable Timing Discrepancy), where two separate operations take measurably different amounts of time, leaking security-relevant information. Spring Security's DaoAuthenticationProvider implements a timing attack defense to prevent user enumeration during authentication; however, this defense is not consistently applied when a user account is in a disabled, expired, or locked state — conditions controlled by the UserDetails interface methods isEnabled(), isAccountNonExpired(), and isAccountNonLocked(). An unauthenticated remote attacker can exploit this by submitting authentication requests and measuring response times to infer whether a given username corresponds to a valid account and what its status is. The vulnerability is only exploitable in applications that actively use these UserDetails attributes for access control, and exploitation requires high attack complexity due to the precision needed for timing measurements (Spring Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to enumerate valid user accounts and infer their status (disabled, expired, or locked) through timing analysis of authentication responses. The confidentiality impact is limited — no credentials or sensitive data are directly exposed — but account enumeration can facilitate targeted credential stuffing, brute-force attacks, or social engineering against identified accounts. There is no integrity or availability impact associated with this vulnerability (Spring Advisory, GitHub Advisory).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.067% (21st percentile), indicating a low near-term probability of exploitation. Exploitation requires high attack complexity, as an attacker must perform precise timing measurements across multiple authentication requests to reliably distinguish account states.

1. Reconnaissance: Identify target applications built on Spring Security that use UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked for account state management. This can be inferred from application behavior or open-source code review.
2. Baseline timing measurement: Send a series of authentication requests with known non-existent usernames to establish a baseline response time for the "user not found" code path.
3. Targeted timing probes: Submit authentication requests for candidate usernames (e.g., from a username wordlist) and measure response times with high precision (e.g., using tools like curl with --write-out '%{time_total}' or custom scripts).
4. Differentiate account states: Compare response times against the baseline. Accounts that are disabled, expired, or locked will exhibit a measurably different timing profile due to the bypass of the constant-time defense in DaoAuthenticationProvider.
5. Enumerate valid accounts: Identify usernames whose response times deviate from the baseline, confirming their existence and inferring their account status (disabled/expired/locked vs. active).
6. Leverage findings: Use the enumerated account list for downstream attacks such as targeted credential stuffing, password spraying, or social engineering (Spring Advisory, GitHub Advisory).

• Network: High volume of authentication requests from a single IP or small IP range targeting the login endpoint, particularly with varied usernames and consistent (likely incorrect) passwords.
• Logs: Application authentication logs showing repeated failed login attempts across many different usernames in rapid succession; patterns of requests that do not match normal user behavior (e.g., systematic username enumeration).
• Logs: Unusual distribution of authentication response times logged at the application or WAF layer, potentially indicating timing-based probing activity.
• Network: Requests originating from automated tools (identifiable by user-agent strings or request cadence) targeting authentication endpoints with no successful logins.

Users of affected versions should upgrade to the corresponding fixed release: 5.7.23 (Enterprise Support only), 5.8.25 (Enterprise Support only), 6.3.16 (Enterprise Support only), 6.4.16 (Enterprise Support only), 6.5.10 (OSS), or 7.0.5 (OSS). The fix also introduces a new setter DaoAuthenticationProvider#setAlwaysPerformAdditionalChecksOnUser; if the upgrade causes unexpected issues, this can be set to false as a temporary measure. Organizations unable to upgrade immediately should consider implementing network-level rate limiting and monitoring on authentication endpoints to detect and slow timing-based enumeration attempts (Spring Advisory, GitHub Advisory).

HeroDevs published a blog post covering this CVE as part of a broader analysis of Spring Security's April 2026 security advisories, which included seven CVEs and two critical authorization bypasses (HeroDevs Blog). IBM issued multiple security bulletins acknowledging the impact of CVE-2026-22746 on IBM Library Support for Spring, IBM Business Automation Manager Open Editions, and IBM Sterling Connect:Direct Web Services (IBM Advisory). General community reaction has been measured given the low CVSS score, with no significant controversy or widespread alarm noted.