This vulnerability in Spring Security arises when applications rely on UserDetails attributes (isEnabled, isAccountNonExpired, isAccountNonLocked) to control user access states. Under these conditions, the timing attack defense implemented in DaoAuthenticationProvider can be bypassed for users who are disabled, expired, or locked. This bypass could allow an attacker to infer user account states through timing analysis. The affected versions span multiple major releases from 5.7.0 to 7.0.4. The CVSS v3.1 base score is 3.7, indicating a low severity with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality impact.

The impact is limited to potential information disclosure about user account states via timing attack bypass. There is no indication of privilege escalation, data modification, or denial of service. The confidentiality impact is low, and no integrity or availability impacts are reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications should review their use of UserDetails attributes for user state management and consider additional mitigations to prevent timing attack information leakage. Monitor official Spring Security advisories for updates and patches addressing this issue.