The original report can be found here.

tl;dr

OncePerRequestFilter implementations are not suitable for CGLib proxying as they use final methods referencing properties that stay null in the wrapping instance.