Spring security 7.0.0 breaks with Micrometer tracing bridge Brave

[viktorgunnarson]

Describe the bug
Using Spring Boot WebFlux (4.0.0) with Spring Security (7.0.0) and micrometer-tracing-bridge-brave dependency breaks the OAuth2 resource server. I have the Hooks.enableAutomaticContextPropagation() in the application main-method.

2025-12-18T14:39:06.833+01:00 ERROR 36632 --- [tracing-fail] [flux-http-nio-2] [694403fa0a8184c709d471f5f595f150-51a62bd3a10c01ff] reactor.core.publisher.Operators         : Operator called default onErrorDropped

java.lang.AssertionError: Observation <{name=spring.security.filterchains(security filterchain before), error=java.lang.IllegalStateException: Could not obtain the keys, context=name='spring.security.filterchains', contextualName='security filterchain before', error='java.lang.IllegalStateException: Could not obtain the keys', lowCardinalityKeyValues=[spring.security.filterchain.position='5', spring.security.filterchain.size='10', spring.security.reached.filter.name='AuthenticationWebFilter', spring.security.reached.filter.section='before'], highCardinalityKeyValues=[], map=[class io.micrometer.tracing.handler.TracingObservationHandler$TracingContext='TracingContext{span=694403fa0a8184c709d471f5f595f150/51a62bd3a10c01ff}'], parentObservation={name=http.server.requests(http get), error=java.lang.IllegalStateException: Could not obtain the keys, context=name='http.server.requests', contextualName='http get', error='java.lang.IllegalStateException: Could not obtain the keys', lowCardinalityKeyValues=[exception='IllegalStateException', method='GET', outcome='SERVER_ERROR', status='500', uri='UNKNOWN'], highCardinalityKeyValues=[http.url='/v1/hello-world'], map=[class io.micrometer.tracing.handler.TracingObservationHandler$TracingContext='TracingContext{span=694403fa0a8184c709d471f5f595f150/09d471f5f595f150}'], parentObservation=null}}> to which we're restoring is not the same as the one set as this scope's parent observation <{name=http.server.requests(http get), error=java.lang.IllegalStateException: Could not obtain the keys, context=name='http.server.requests', contextualName='http get', error='java.lang.IllegalStateException: Could not obtain the keys', lowCardinalityKeyValues=[exception='IllegalStateException', method='GET', outcome='SERVER_ERROR', status='500', uri='UNKNOWN'], highCardinalityKeyValues=[http.url='/v1/hello-world'], map=[class io.micrometer.tracing.handler.TracingObservationHandler$TracingContext='TracingContext{span=694403fa0a8184c709d471f5f595f150/09d471f5f595f150}'], parentObservation=null}>. Most likely a manually created Observation has a scope opened that was never closed. This may lead to thread polluting and memory leaks.
	at io.micrometer.observation.contextpropagation.ObservationThreadLocalAccessor.assertFalse(ObservationThreadLocalAccessor.java:199) ~[micrometer-observation-1.16.0.jar:1.16.0]
	at io.micrometer.observation.contextpropagation.ObservationThreadLocalAccessor.restore(ObservationThreadLocalAccessor.java:193) ~[micrometer-observation-1.16.0.jar:1.16.0]
	at io.micrometer.observation.contextpropagation.ObservationThreadLocalAccessor.restore(ObservationThreadLocalAccessor.java:34) ~[micrometer-observation-1.16.0.jar:1.16.0]
	at io.micrometer.context.DefaultContextSnapshot$DefaultScope.resetThreadLocalValue(DefaultContextSnapshot.java:151) ~[context-propagation-1.2.0.jar:1.2.0]
	at io.micrometer.context.DefaultContextSnapshot$DefaultScope.close(DefaultContextSnapshot.java:143) ~[context-propagation-1.2.0.jar:1.2.0]
	at reactor.core.publisher.MonoContextWriteRestoringThreadLocals.subscribe(MonoContextWriteRestoringThreadLocals.java:45) ~[reactor-core-3.8.0.jar:3.8.0]
	at reactor.core.publisher.InternalMonoOperator.subscribe(InternalMonoOperator.java:75) ~[reactor-core-3.8.0.jar:3.8.0]
	at reactor.core.publisher.MonoContextWriteRestoringThreadLocals.subscribe(MonoContextWriteRestoringThreadLocals.java:44) ~[reactor-core-3.8.0.jar:3.8.0]
	at reactor.core.publisher.MonoDeferContextual.subscribe(MonoDeferContextual.java:56) ~[reactor-core-3.8.0.jar:3.8.0]
	at reactor.core.publisher.InternalMonoOperator.subscribe(InternalMonoOperator.java:75) ~[reactor-core-3.8.0.jar:3.8.0]
	at reactor.core.publisher.MonoDefer.subscribe(MonoDefer.java:54) ~[reactor-core-3.8.0.jar:3.8.0]
	at reactor.core.publisher.MonoFlatMap$FlatMapMain.onNext(MonoFlatMap.java:166) ~[reactor-core-3.8.0.jar:3.8.0]
	at reactor.core.publisher.FluxMapFuseable$MapFuseableSubscriber.onNext(FluxMapFuseable.java:130) ~[reactor-core-3.8.0.jar:3.8.0]
...

To Reproduce
Run the unit test in the linked sample.

Expected behavior
The application should not break because of adding tracing.

Sample
https://github.com/viktorgunnarson/tracing-fail

This issue might be related to #13431 .