Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Spring Boot Authentication bypass using an alternate path or channel Vulnerability - CVE-2026-22731 - Vulnerability Database
Spring Boot

Spring Boot Authentication bypass using an alternate path or channel Vulnerability - CVE-2026-22731

High
Reference: CVE-2026-22731
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-22731
Title: Spring Boot Authentication bypass using an alternate path or channel Vulnerability
Overview:

Spring Boot applications with Actuator can be vulnerable to an Authentication Bypass vulnerability when an application endpoint that requires authentication is declared under a specific path already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3 from 3.5 before 3.5.11 from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733 as the conditions for exploit and vulnerable versions are different.