CVE-2026-22751
Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions
CVE-2026-22751 is a medium vulnerability (CVSS 4.8) in Spring Security, published April 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 2nd percentile. Fixed in org.springframework.security:spring-security-core 6.5.10.
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
CVE-2026-22751- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-367
- Updated
- 2026-11-02
EUVDEUVD-2026-24227
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
EUVD-2026-24227- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x2wq-9x2f-fhj7
Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
GHSA-x2wq-9x2f-fhj7- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-367
- Updated
- 2026-11-02
NVD
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
CVE-2026-22751- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-367
- Updated
- 2026-11-02
OSV
Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
CVE-2026-22751- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-x2wq-9x2f-fhj7
Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
GHSA-x2wq-9x2f-fhj7- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-367
- Updated
- 2026-11-02
Show 4 moreShow less
OSVRHLW-2026-8fd370b9b3e9924a
Lightwell Security Advisory: spring-security-core 6.5.7.rhlw-00002
Red Hat Lightwell has released org.springframework.security:spring-security-core 6.5.7.rhlw-00002 with backported fixes for CVE-2026-22746 and CVE-2026-22751.
CVE-2026-22746: User Attribute Enumeration when Using DaoAuthenticationProvider
CVE-2026-22751: Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions
This patched artifact is a drop-in replacement for org.springframework.security:spring-security-core 6.5.7 from Maven Central.
- Record
RHLW-2026-8fd370b9b3e9924a- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-22751
CVE-2026-22751 in io.root.org.springframework.security:spring-security-core - Patched by Root
Root has patched CVE-2026-22751 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-22751- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1779151636 No score
TuxCare security update for org.springframework.security:spring-security-core (2 CVEs)
TuxCare rebuilt org.springframework.security:spring-security-core to address 2 CVEs. Fixed in 6.4.3-tuxcare.2.
- Record
CLSA-2026-1779151636- Updated
- 2026-11-02
OSVCLSA-2026-1787157249 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 6.4.13-tuxcare.2.
- Record
CLSA-2026-1787157249- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-coreMaven |
6.5.0 up to 6.5.10 | 6.5.10 |
org.springframework.security:spring-security-coreMaven |
7.0.3 up to 7.0.5 | 7.0.5 |
org.springframework.security:spring-security-coreMaven |
6.4.0 to 6.4.13 | None known |
org.springframework.security:spring-security-coreTuxCare:Maven |
6.4.3 up to 6.4.3-tuxcare.2, plus listed versions 6.4.3-tuxcare.1 |
6.4.3-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-coreMaven |
6.5.0 up to 6.5.10, plus listed versions 6.5.16.5.26.5.36.5.46.5.5 Show 4 moreShow less6.5.66.5.76.5.86.5.9 |
6.5.10 |
org.springframework.security:spring-security-coreMaven |
7.0.3 up to 7.0.5, plus listed versions 7.0.4 |
7.0.5 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-coreMaven |
6.4.0 to 6.4.13, plus listed versions 6.4.16.4.106.4.116.4.126.4.2 Show 7 moreShow less6.4.36.4.46.4.56.4.66.4.76.4.86.4.9 |
None known |
org.springframework.security:spring-security-coreRed Hat Lightwell:Maven |
before 6.5.7.rhlw-00002, plus listed versions 2.0.02.0.12.0.22.0.32.0.4 Show 45 moreShow less2.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE2.0.8.RELEASE3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE |
6.5.7.rhlw-00002 |
io.root.org.springframework.security:spring-security-coreRoot:Maven |
before 6.5.9-root.io.1 | 6.5.9-root.io.16.5.9-root.io.26.5.9-root.io.36.5.9-root.io.46.5.9-root.io.5 |
org.springframework.security:spring-security-coreRoot:Maven |
before 6.5.9-aikido.2 | 6.5.9-aikido.26.5.9-aikido.36.5.9-aikido.46.5.9-aikido.5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | affected | OSV |
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
spring.io/security/cve-2026-22751
nvd.nist.gov/vuln/detail/CVE-2026-22751
github.com/spring-projects/spring-security/commit/163772775036c4146815a5266874278c6f45f047
jinyeong.seol.pro/blogs/cve-2026-22751/en
Show 6 moreShow less
Left out here: 210 versions. The JSON record has them.