CVE-2026-22748
Potential Security Misconfiguration when Using withIssuerLocation
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Potential Security Misconfiguration when Using withIssuerLocation
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
CVE-2026-22748- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2026-24610
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
EUVD-2026-24610- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cvc6-q2cp-2xhw
Spring Security has Potential Security Misconfiguration when Using withIssuerLocation
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator. This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
GHSA-cvc6-q2cp-2xhw- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
CVE-2026-22748- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Potential Security Misconfiguration when Using withIssuerLocation
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
CVE-2026-22748- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-cvc6-q2cp-2xhw
Spring Security has Potential Security Misconfiguration when Using withIssuerLocation
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator. This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
GHSA-cvc6-q2cp-2xhw- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
Show 5 moreShow less
OSVCLSA-2026-1786563390 No score
TuxCare security update for org.springframework.security:spring-security-oauth2-jose (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-oauth2-jose to address 1 CVE. Fixed in 6.2.7-tuxcare.3.
- Record
CLSA-2026-1786563390- Updated
- 2026-11-02
OSVCLSA-2026-1786627230 No score
TuxCare security update for org.springframework.security (3 CVEs)
TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.8-tuxcare.2.
- Record
CLSA-2026-1786627230- Updated
- 2026-11-02
OSVCLSA-2026-1787157249 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 6.4.13-tuxcare.2.
- Record
CLSA-2026-1787157249- Updated
- 2026-11-02
OSVCLSA-2026-1790159292 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 9 CVEs. Fixed in 6.3.9-tuxcare.1.
- Record
CLSA-2026-1790159292- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-22748 No score
CVE-2026-22748 in io.root.org.springframework.security:spring-security-oauth2-jose - Patched by Root
Root has patched CVE-2026-22748 in the io.root.org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-22748- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-oauth2-joseMaven |
6.3.0 to 6.3.14 | None known |
org.springframework.security:spring-security-oauth2-joseMaven |
6.4.0 to 6.4.14 | None known |
org.springframework.security:spring-security-oauth2-joseMaven |
6.5.0 to 6.5.9 | 6.5.10 |
org.springframework.security:spring-security-oauth2-joseMaven |
7.0.0 to 7.0.4 | 7.0.5 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven |
6.2.7 up to 6.2.7-tuxcare.3, plus listed versions 6.2.7-tuxcare.16.2.7-tuxcare.2 |
6.2.7-tuxcare.3 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 3 CVEs |
6.2.8 up to 6.2.8-tuxcare.2, plus listed versions 6.2.8-tuxcare.1 |
6.2.8-tuxcare.2 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 3 CVEs |
6.2.8 up to 6.2.8-tuxcare.2, plus listed versions 6.2.8-tuxcare.1 |
6.2.8-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 3 CVEs |
6.2.8 up to 6.2.8-tuxcare.2, plus listed versions 6.2.8-tuxcare.1 |
6.2.8-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-oauth2-joseMaven |
6.3.0 to 6.3.14, plus listed versions 6.3.16.3.106.3.26.3.36.3.4 Show 5 moreShow less6.3.56.3.66.3.76.3.86.3.9 |
None known |
org.springframework.security:spring-security-oauth2-joseMaven |
6.4.0 to 6.4.14, plus listed versions 6.4.16.4.106.4.116.4.126.4.13 Show 8 moreShow less6.4.26.4.36.4.46.4.56.4.66.4.76.4.86.4.9 |
None known |
org.springframework.security:spring-security-oauth2-joseMaven |
6.5.0 up to 6.5.10, plus listed versions 6.5.16.5.26.5.36.5.46.5.5 Show 4 moreShow less6.5.66.5.76.5.86.5.9 |
6.5.10 |
org.springframework.security:spring-security-oauth2-joseMaven |
7.0.0 up to 7.0.5, plus listed versions 7.0.17.0.27.0.37.0.4 |
7.0.5 |
io.root.org.springframework.security:spring-security-oauth2-joseRoot:Maven |
before 6.3.3-root.io.1 | 6.3.3-root.io.16.5.9-root.io.16.3.3-root.io.26.5.9-root.io.26.3.3-root.io.17814506986.5.9-root.io.36.5.9-root.io.46.5.9-root.io.5 |
org.springframework.security:spring-security-oauth2-joseRoot:Maven |
before 6.3.3-aikido.2 | 6.3.3-aikido.26.5.9-aikido.26.3.3-aikido.17814506986.5.9-aikido.36.5.9-aikido.46.5.9-aikido.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-22748 is a medium vulnerability (CVSS 5.3) in Spring Security, published April 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in org.springframework.security:spring-security-oauth2-jose 6.5.10.