Authentication Bypass by Spoofing

Summary

The spring security versions 6.4.0-M2 through 6.4.3, and 6.5.0-M1 through 6.5.0-M2 may not correctly locate method security annotations on parameterized types or methods, potentially leading to an authorization bypass. Users are not affected if they are not using "@EnableMethodSecurity", if they do not have method security annotations on parameterized types or methods, or if all method security annotations are attached directly to the target methods.