关键信息 CVE编号: CVE-2025-41248 漏洞类型: Spring Security authorization bypass for method security annotations on parameterized types 严重程度: MEDIUM 发布日期: September 15, 2025 描述: - Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. - This can be an issue when using and other method security annotations, resulting in an authorization bypass. 受影响的产品和版本: - Spring Security: - 6.4.0 - 6.4.9 - 6.5.0 - 6.5.3 缓解措施: - Follow the mitigation steps in CVE-2025-41249. - Upgrade to the corresponding fixed version: 发现者: An anonymous individual 参考链接: NVD