Spring Security 6.4.0 through 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. Your application may be affected by this if the following are true: You are using @EnableMethodSecurity, and You have a method security annotation on a parameterized superclass, interface, or overridden method and no annotation on the target method. This issue is fixed in version 6.4.4.