diff --git a/web/src/main/java/org/springframework/security/web/util/matcher/IpAddressMatcher.java b/web/src/main/java/org/springframework/security/web/util/matcher/IpAddressMatcher.java
index a235b59dd99..b9a25bc1d2b 100644
--- a/web/src/main/java/org/springframework/security/web/util/matcher/IpAddressMatcher.java
+++ b/web/src/main/java/org/springframework/security/web/util/matcher/IpAddressMatcher.java
@@ -130,4 +130,12 @@ private InetAddress parseAddress(String address) {
 		}
 	}
 
+	public InetAddress getRequiredAddress() {
+		return this.requiredAddress;
+	}
+
+	public int getMaskBits() {
+		return this.nMaskBits;
+	}
+
 }
diff --git a/web/src/test/java/org/springframework/security/web/util/matcher/IpAddressMatcherTests.java b/web/src/test/java/org/springframework/security/web/util/matcher/IpAddressMatcherTests.java
index ce702bfbebb..b6a24c6ead5 100644
--- a/web/src/test/java/org/springframework/security/web/util/matcher/IpAddressMatcherTests.java
+++ b/web/src/test/java/org/springframework/security/web/util/matcher/IpAddressMatcherTests.java
@@ -152,5 +152,18 @@ public void constructorWhenRequiredAddressIsEmptyThenThrowsIllegalArgumentExcept
 		assertThatIllegalArgumentException().isThrownBy(() -> new IpAddressMatcher(""))
 			.withMessage("ipAddress cannot be empty");
 	}
+	// gh-16693
+	@Test
+	public void getRequiredAddressWhenCidrIsValidThenReturnsHostAddress() {
+		IpAddressMatcher ipAddressMatcher = new IpAddressMatcher("192.168.1.0/24");
+		assertThat(ipAddressMatcher.getRequiredAddress().getHostAddress()).isEqualTo("192.168.1.0");
+	}
+
+	// gh-16693
+	@Test
+	public void getRequiredAddressWhenCidrIsValidThenReturnsMaskBits() {
+		IpAddressMatcher ipAddressMatcher = new IpAddressMatcher("192.168.1.0/24");
+		assertThat(ipAddressMatcher.getMaskBits()).isEqualTo(24);
+	}
 
 }