How many CVEs have patched authenticate?

2 published CVEs changed authenticate in spring-projects/spring-security, in 2 distinct patches totalling 11 changed lines, between 2017 and 2026.

What is the latest CVE that changed authenticate?

CVE-2026-22751 (Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions), published 2026-04-21, changed lines 159 to 169 of core/src/main/java/org/springframework/security/authentication/dao/AbstractUserDetailsAuthenticationProvider.java.

How does authenticate compare to the rest of spring-projects/spring-security?

spring-projects/spring-security has 14 CVEs with a located fix in total; 2 of them changed authenticate.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

RadicalNotion.AI

Log in Create an account

spring-projects/spring-security

Function

2 files

authenticate

Name: authenticate in spring-projects/spring-security: CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Defined in 2 files

Last patched April 21, 2026

2

CVEs

That changed this function

2

Distinct patches

Backports counted once

11

Lines changed

Added plus removed

2017–2026

Years

By CVE publication date

Overview

authenticate in spring-projects/spring-security was changed by 2 published CVE fixes between 2017 and 2026, in 2 distinct patches that added or removed 11 lines in total.

The name occurs in 2 files: core/src/main/java/org/springframework/security/authentication/dao/AbstractUserDetailsAuthenticationProvider.java, ldap/src/main/java/org/springframework/security/ldap/authentication/AbstractLdapAuthenticationProvider.java.

spring-projects/spring-security has 14 CVEs with a located fix in total, so 14% of them touched this function.

CVEs that patched it

Every published CVE whose fix changed authenticate, newest first, with the lines each fix touched.

Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions
CVE-2026-22751 · core/src/main/java/org/springframework/security/authentication/dao/AbstractUserDetailsAuthenticationProvider.java · lines 159–169 · +2 −4 in 2 hunks
Medium · CVSS 4.8
EPSS 0.1%2026-04-21
Improper Authentication in Spring Security
CVE-2014-0097 · ldap/src/main/java/org/springframework/security/ldap/authentication/AbstractLdapAuthenticationProvider.java · lines 73–77 · +5 −0
High · CVSS 7.3
EPSS 1.2%2017-05-25

Get an alert when the next CVE fix lands in spring-projects/spring-security, with the patched functions.

Monitor spring-security CVEs

Other functions in these files

Functions in the same files that CVE fixes also changed.

Other hotspots in the repository

Functions in spring-projects/spring-security changed by the most CVE fixes.

hashpw2 CVEs · crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCrypt.java deleteOneTimeToken1 CVEs · core/src/main/java/org/springframework/security/authentication/ott/JdbcOneTimeTokenService.java hasSameGenericTypeParameters1 CVEs · core/src/main/java/org/springframework/security/core/annotation/UniqueSecurityAnnotationScanner.java findDirectAnnotations1 CVEs · core/src/main/java/org/springframework/security/core/annotation/UniqueSecurityAnnotationScanner.java flatMap1 CVEs · web/src/main/java/org/springframework/security/web/server/WebFilterChainProxy.java crypt_raw1 CVEs · crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCrypt.java

All patched functions in spring-projects/spring-security

Frequently asked questions

Common questions about CVE fixes to authenticate.

How many CVEs have patched authenticate?: 2 published CVEs changed authenticate in spring-projects/spring-security, in 2 distinct patches totalling 11 changed lines, between 2017 and 2026.
What is the latest CVE that changed authenticate?: CVE-2026-22751 (Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions), published 2026-04-21, changed lines 159 to 169 of core/src/main/java/org/springframework/security/authentication/dao/AbstractUserDetailsAuthenticationProvider.java.
How does authenticate compare to the rest of spring-projects/spring-security?: spring-projects/spring-security has 14 CVEs with a located fix in total; 2 of them changed authenticate.
What do the line numbers refer to?: Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track spring-projects/spring-security CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing