SEC-1143: Fixed by using BeanDefinitionRegistry.isBeanNameInUse() instead of containsBeanDefinition() to check for the SessionRegistry availability. The former picks up the alias registration of the standard bean Id for user's bean Id.

core/src/main/java/org/springframework/security/util/FieldUtils.java

@@ -91,7 +91,9 @@ public final class FieldUtils {
             field = getField(componentClass, nestedFields[i]);
             field.setAccessible(true);
             value = field.get(value);
-            componentClass = value.getClass();
+            if (value != null) {
+                componentClass = value.getClass();
+            }
         }
 
         return value;