Listen to this Post
The DaoAuthenticationProvider in Spring Security previously implemented a constant-time algorithm for password comparison to mitigate timing attacks, which attempt to deduce valid credentials by measuring response time differences. The fix for a previous vulnerability inadvertently introduced a flaw where the authentication process could exit early under specific conditions before reaching this constant-time comparison. This early exit occurs when features like account locking, credentials expiration, or other pre-authentication checks are enabled and fail. The time difference between an early exit (for a non-existent or locked user) and the full password comparison path (for a valid, active user) is measurable. An attacker can exploit this by sending many authentication requests with various usernames and precisely measuring the server’s response times. Statistically significant shorter response times indicate that the request triggered an early failure in the authentication flow, potentially revealing that a username is invalid, locked, or otherwise non-conforming. Conversely, consistently longer response times suggest the username is valid and proceeded to the password comparison stage, enabling username enumeration.
Platform: Spring Security
Version: 6.3.8, 6.4.4
Vulnerability: Broken Timing Mitigation
Severity: Moderate
Date: January 22, 2026
Prediction: Patch Expected: January 30, 2026
What Undercode Say:
Analytics
`curl -s http://target/login -X POST -d ‘user=test&pass=wrong’ -w ‘%{time_total}’ -o /dev/null`
`for user in $(cat wordlist.txt); do time=$(curl -s … -d “user=$user”… -w ‘%{time_total}’ …); echo “$user:$time” >> times.log; done`
`sort -t: -k2 -n times.log | tail -5`
How Exploit:
1. Attacker sends authentication requests.
2. Measures response times meticulously.
3. Identifies longer duration responses.
4. Correlates times to usernames.
5. Enumerates valid account identifiers.
Protection from this CVE
1. Upgrade to patched versions (6.3.9, 6.4.5).
2. Implement external rate limiting.
3. Use multi-factor authentication (MFA).
Impact:
Username Enumeration, Information Disclosure, Targeted Attack Facilitation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
