Due to security issues, authentication is bypassable in the context of VMware Tanzu Spring Security, among other things.
AiTM attacks don't steal passwords; they copy the result of a real login. You need to watch what happens after the user logs ...