CVE-2026-22746
User Attribute Enumeration when Using DaoAuthenticationProvider
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
User Attribute Enumeration when Using DaoAuthenticationProvider
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
CVE-2026-22746- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-208
- Updated
- 2026-11-02
EUVDEUVD-2026-24607
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
EUVD-2026-24607- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vxf7-qj7q-83fh
Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
GHSA-vxf7-qj7q-83fh- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-208
- Updated
- 2026-11-02
NVD
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
CVE-2026-22746- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-208
- Updated
- 2026-11-02
OSV
User Attribute Enumeration when Using DaoAuthenticationProvider
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
CVE-2026-22746- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-vxf7-qj7q-83fh
Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
GHSA-vxf7-qj7q-83fh- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-208
- Updated
- 2026-11-02
Show 28 moreShow less
OSVRHLW-2026-630128d9882e951f
Lightwell Security Advisory: spring-security-core 5.7.11.rhlw-00006
Red Hat Lightwell has released org.springframework.security:spring-security-core 5.7.11.rhlw-00006 with backported fixes for CVE-2024-22257, CVE-2024-38827, and CVE-2026-22746.
CVE-2026-22746: User Attribute Enumeration when Using DaoAuthenticationProvider
This patched artifact is a drop-in replacement for org.springframework.security:spring-security-core 5.7.11 from Maven Central.
- Record
RHLW-2026-630128d9882e951f- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVRHLW-2026-8fd370b9b3e9924a
Lightwell Security Advisory: spring-security-core 6.5.7.rhlw-00002
Red Hat Lightwell has released org.springframework.security:spring-security-core 6.5.7.rhlw-00002 with backported fixes for CVE-2026-22746 and CVE-2026-22751.
CVE-2026-22746: User Attribute Enumeration when Using DaoAuthenticationProvider
CVE-2026-22751: Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions
This patched artifact is a drop-in replacement for org.springframework.security:spring-security-core 6.5.7 from Maven Central.
- Record
RHLW-2026-8fd370b9b3e9924a- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1779151636 No score
TuxCare security update for org.springframework.security:spring-security-core (2 CVEs)
TuxCare rebuilt org.springframework.security:spring-security-core to address 2 CVEs. Fixed in 6.4.3-tuxcare.2.
- Record
CLSA-2026-1779151636- Updated
- 2026-11-02
OSVCLSA-2026-1779238053 No score
TuxCare security update for org.springframework.security:spring-security-core (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-core to address 1 CVE. Fixed in 6.2.2-tuxcare.2.
- Record
CLSA-2026-1779238053- Updated
- 2026-11-02
OSVCLSA-2026-1779238057 No score
TuxCare security update for org.springframework.security:spring-security-core (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-core to address 1 CVE. Fixed in 6.3.10-tuxcare.4.
- Record
CLSA-2026-1779238057- Updated
- 2026-11-02
OSVCLSA-2026-1779324466 No score
TuxCare security update for org.springframework.security:spring-security-core (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-core to address 1 CVE. Fixed in 6.1.6-tuxcare.4.
- Record
CLSA-2026-1779324466- Updated
- 2026-11-02
OSVCLSA-2026-1779410899 No score
TuxCare security update for org.springframework.security:spring-security-core (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-core to address 1 CVE. Fixed in 4.2.20.RELEASE-tuxcare.4.
- Record
CLSA-2026-1779410899- Updated
- 2026-11-02
OSVCLSA-2026-1779670112 No score
TuxCare security update for org.springframework.security:spring-security-core (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-core to address 1 CVE. Fixed in 5.8.16-tuxcare.8.
- Record
CLSA-2026-1779670112- Updated
- 2026-11-02
OSVCLSA-2026-1779842934 No score
TuxCare security update for org.springframework.security:spring-security-core (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-core to address 1 CVE. Fixed in 5.7.14-tuxcare.2.
- Record
CLSA-2026-1779842934- Updated
- 2026-11-02
OSVCLSA-2026-1779929351 No score
TuxCare security update for org.springframework.security:spring-security-core (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-core to address 1 CVE. Fixed in 5.7.12-tuxcare.5.
- Record
CLSA-2026-1779929351- Updated
- 2026-11-02
OSVCLSA-2026-1781657691 No score
TuxCare security update for org.springframework.security:spring-security-core (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-core to address 1 CVE. Fixed in 5.7.11-tuxcare.3.
- Record
CLSA-2026-1781657691- Updated
- 2026-11-02
OSVCLSA-2026-1783040466 No score
TuxCare security update for org.springframework.security:spring-security-core (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-core to address 1 CVE. Fixed in 5.6.10-tuxcare.5.
- Record
CLSA-2026-1783040466- Updated
- 2026-11-02
OSVCLSA-2026-1786348732 No score
TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 6.2.7-tuxcare.2.
- Record
CLSA-2026-1786348732- Updated
- 2026-11-02
OSVCLSA-2026-1786627230 No score
TuxCare security update for org.springframework.security (3 CVEs)
TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.8-tuxcare.2.
- Record
CLSA-2026-1786627230- Updated
- 2026-11-02
OSVCLSA-2026-1787157249 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 6.4.13-tuxcare.2.
- Record
CLSA-2026-1787157249- Updated
- 2026-11-02
OSVCLSA-2026-1788804966 No score
TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 6.0.8-tuxcare.3.
- Record
CLSA-2026-1788804966- Updated
- 2026-11-02
OSVCLSA-2026-1789676383 No score
TuxCare security update for org.springframework.security (8 CVEs)
TuxCare rebuilt 3 org.springframework.security packages to address 8 CVEs. Fixed in 5.8.14-tuxcare.1.
- Record
CLSA-2026-1789676383- Updated
- 2026-11-02
OSVCLSA-2026-1790159292 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 9 CVEs. Fixed in 6.3.9-tuxcare.1.
- Record
CLSA-2026-1790159292- Updated
- 2026-11-02
OSVCLSA-2026-1791380003 No score
TuxCare security update for org.springframework.security (11 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.7.7-tuxcare.1.
- Record
CLSA-2026-1791380003- Updated
- 2026-11-02
OSVCLSA-2026-1791391633 No score
TuxCare security update for org.springframework.security (11 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.5.8-tuxcare.1.
- Record
CLSA-2026-1791391633- Updated
- 2026-11-02
OSVCLSA-2026-1791392813 No score
TuxCare security update for org.springframework.security (10 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.9-tuxcare.1.
- Record
CLSA-2026-1791392813- Updated
- 2026-11-02
OSVCLSA-2026-1792079446 No score
TuxCare security update for org.springframework.security (15 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 15 CVEs. Fixed in 6.0.7-tuxcare.1.
- Record
CLSA-2026-1792079446- Updated
- 2026-11-02
OSVCLSA-2026-1792084952 No score
TuxCare security update for org.springframework.security (11 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 11 CVEs. Fixed in 5.8.15-tuxcare.2.
- Record
CLSA-2026-1792084952- Updated
- 2026-11-02
OSVCLSA-2026-1792102802 No score
TuxCare security update for org.springframework.security (8 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 8 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792102802- Updated
- 2026-11-02
OSVCLSA-2026-1792502421 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 5.1.4.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792502421- Updated
- 2026-11-02
OSVCLSA-2026-1792503291 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792503291- Updated
- 2026-11-02
OSVCLSA-2026-1792588191 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 3.2.8.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792588191- Updated
- 2026-11-02
OSVCLSA-2026-1793729146 No score
TuxCare security update for org.springframework.security (3 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 3 CVEs. Fixed in 5.6.7-tuxcare.3.
- Record
CLSA-2026-1793729146- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-coreMaven |
5.7.0 to 5.7.22 | None known |
org.springframework.security:spring-security-coreMaven |
5.8.0 to 5.8.24 | None known |
org.springframework.security:spring-security-coreMaven |
6.3.0 to 6.3.15 | None known |
org.springframework.security:spring-security-coreMaven |
6.4.0 to 6.4.15 | None known |
org.springframework.security:spring-security-coreMaven |
6.5.0 to 6.5.9 | 6.5.10 |
org.springframework.security:spring-security-coreMaven |
7.0.0 to 7.0.4 | 7.0.5 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 2 CVEs |
6.4.3 up to 6.4.3-tuxcare.2, plus listed versions 6.4.3-tuxcare.1 |
6.4.3-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven |
6.2.2 up to 6.2.2-tuxcare.2, plus listed versions 6.2.2-tuxcare.1 |
6.2.2-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven |
6.3.10 up to 6.3.10-tuxcare.4, plus listed versions 6.3.10-tuxcare.16.3.10-tuxcare.26.3.10-tuxcare.3 |
6.3.10-tuxcare.4 |
org.springframework.security:spring-security-coreTuxCare:Maven |
6.1.6 up to 6.1.6-tuxcare.4, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.3 |
6.1.6-tuxcare.4 |
Show 74 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-coreTuxCare:Maven |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.4, plus listed versions 4.2.20.RELEASE-tuxcare.14.2.20.RELEASE-tuxcare.24.2.20.RELEASE-tuxcare.3 |
4.2.20.RELEASE-tuxcare.4 |
org.springframework.security:spring-security-coreTuxCare:Maven |
5.8.16 up to 5.8.16-tuxcare.8, plus listed versions 5.8.16-tuxcare.45.8.16-tuxcare.55.8.16-tuxcare.65.8.16-tuxcare.75.8.16.tuxcare5.8.16.tuxcare.15.8.16.tuxcare.25.8.16.tuxcare.3 |
5.8.16-tuxcare.8 |
org.springframework.security:spring-security-coreTuxCare:Maven |
5.7.14 up to 5.7.14-tuxcare.2, plus listed versions 5.7.14-tuxcare.1 |
5.7.14-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven |
5.7.12 up to 5.7.12-tuxcare.5, plus listed versions 5.7.12-tuxcare.15.7.12-tuxcare.25.7.12-tuxcare.35.7.12-tuxcare.4 |
5.7.12-tuxcare.5 |
org.springframework.security:spring-security-coreTuxCare:Maven |
5.7.11 up to 5.7.11-tuxcare.3, plus listed versions 5.7.11-tuxcare.15.7.11-tuxcare.25.7.11.tuxcare |
5.7.11-tuxcare.3 |
org.springframework.security:spring-security-coreTuxCare:Maven |
5.6.10 up to 5.6.10-tuxcare.5, plus listed versions 5.6.10-tuxcare.15.6.10-tuxcare.25.6.10-tuxcare.35.6.10-tuxcare.4 |
5.6.10-tuxcare.5 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 2 CVEs |
6.2.7 up to 6.2.7-tuxcare.2, plus listed versions 6.2.7-tuxcare.1 |
6.2.7-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 2 CVEs |
6.2.7 up to 6.2.7-tuxcare.2, plus listed versions 6.2.7-tuxcare.1 |
6.2.7-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 3 CVEs |
6.2.8 up to 6.2.8-tuxcare.2, plus listed versions 6.2.8-tuxcare.1 |
6.2.8-tuxcare.2 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 3 CVEs |
6.2.8 up to 6.2.8-tuxcare.2, plus listed versions 6.2.8-tuxcare.1 |
6.2.8-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 3 CVEs |
6.2.8 up to 6.2.8-tuxcare.2, plus listed versions 6.2.8-tuxcare.1 |
6.2.8-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 2 CVEs |
6.0.8 up to 6.0.8-tuxcare.3, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.2 |
6.0.8-tuxcare.3 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 2 CVEs |
6.0.8 up to 6.0.8-tuxcare.3, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.2 |
6.0.8-tuxcare.3 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 8 CVEs |
5.8.14 up to 5.8.14-tuxcare.1 | 5.8.14-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 8 CVEs |
5.8.14 up to 5.8.14-tuxcare.1 | 5.8.14-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 8 CVEs |
5.8.14 up to 5.8.14-tuxcare.1 | 5.8.14-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 10 CVEs |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 10 CVEs |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 10 CVEs |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 10 CVEs |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 11 CVEs |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 11 CVEs |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 11 CVEs |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 11 CVEs |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 11 CVEs |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 8 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 8 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 8 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 8 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 6 CVEs |
5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1 | 5.1.4.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 6 CVEs |
5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1 | 5.1.4.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 6 CVEs |
5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1 | 5.1.4.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 6 CVEs |
5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1 | 5.1.4.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-casTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 3 CVEs |
5.6.7 up to 5.6.7-tuxcare.3, plus listed versions 5.6.7-tuxcare.15.6.7-tuxcare.2 |
5.6.7-tuxcare.3 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 3 CVEs |
5.6.7 up to 5.6.7-tuxcare.3, plus listed versions 5.6.7-tuxcare.15.6.7-tuxcare.2 |
5.6.7-tuxcare.3 |
org.springframework.security:spring-security-coreMaven |
5.7.0 to 5.7.22, plus listed versions 5.7.15.7.105.7.115.7.125.7.13 Show 9 moreShow less5.7.145.7.25.7.35.7.45.7.55.7.65.7.75.7.85.7.9 |
None known |
org.springframework.security:spring-security-coreMaven |
5.8.0 to 5.8.24, plus listed versions 5.8.15.8.105.8.115.8.125.8.13 Show 11 moreShow less5.8.145.8.155.8.165.8.25.8.35.8.45.8.55.8.65.8.75.8.85.8.9 |
None known |
org.springframework.security:spring-security-coreMaven |
6.3.0 to 6.3.15, plus listed versions 6.3.16.3.106.3.26.3.36.3.4 Show 5 moreShow less6.3.56.3.66.3.76.3.86.3.9 |
None known |
org.springframework.security:spring-security-coreMaven |
6.4.0 to 6.4.15, plus listed versions 6.4.16.4.106.4.116.4.126.4.13 Show 8 moreShow less6.4.26.4.36.4.46.4.56.4.66.4.76.4.86.4.9 |
None known |
org.springframework.security:spring-security-coreMaven |
6.5.0 up to 6.5.10, plus listed versions 6.5.16.5.26.5.36.5.46.5.5 Show 4 moreShow less6.5.66.5.76.5.86.5.9 |
6.5.10 |
org.springframework.security:spring-security-coreMaven |
7.0.0 up to 7.0.5, plus listed versions 7.0.17.0.27.0.37.0.4 |
7.0.5 |
org.springframework.security:spring-security-coreRed Hat Lightwell:Maven From an advisory covering 3 CVEs |
before 5.7.11.rhlw-00006, plus listed versions 2.0.02.0.12.0.22.0.32.0.4 Show 45 moreShow less2.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE2.0.8.RELEASE3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE |
5.7.11.rhlw-00006 |
org.springframework.security:spring-security-coreRed Hat Lightwell:Maven From an advisory covering 2 CVEs |
before 6.5.7.rhlw-00002, plus listed versions 2.0.02.0.12.0.22.0.32.0.4 Show 45 moreShow less2.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE2.0.8.RELEASE3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE |
6.5.7.rhlw-00002 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| affected, affected_more | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-22746 is a low vulnerability (CVSS 3.7) in Spring Security, published April 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 12th percentile. Fixed in org.springframework.security:spring-security-core 6.5.10.
References
Left out here: 339 versions. The JSON record has them.