This vulnerability affects Spring Security versions 7.0.0 through 7.0.4. When an application uses securityMatchers(String) along with a PathPatternRequestMatcher.Builder bean to prepend a servlet path, the matching of requests to the security filter chain may fail. Consequently, the security components such as authentication and authorization may not be exercised on those requests, effectively disabling intended security controls. The issue is tracked as CVE-2026-22753 and is categorized under CWE-693 (Protection Mechanism Failure). The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity and no privileges or user interaction required, impacting integrity but not confidentiality or availability.

The impact of this vulnerability is that security controls including authentication and authorization may be bypassed for certain requests due to incorrect request matching in the filter chain. This can allow unauthorized users to perform actions that should be restricted, compromising the integrity of the application. There is no indication that confidentiality or availability are affected. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review their use of securityMatchers(String) and PathPatternRequestMatcher.Builder beans to ensure that servlet path prepending does not cause security filters to be bypassed. Consider alternative configurations or additional manual checks to enforce security controls on all relevant requests.