CVE-2026-22748
Potential Security Misconfiguration when Using withIssuerLocation
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Potential Security Misconfiguration when Using withIssuerLocation
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
CVE-2026-22748- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2026-24610
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
EUVD-2026-24610- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cvc6-q2cp-2xhw
Spring Security has Potential Security Misconfiguration when Using withIssuerLocation
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator. This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
GHSA-cvc6-q2cp-2xhw- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
CVE-2026-22748- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Potential Security Misconfiguration when Using withIssuerLocation
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
CVE-2026-22748- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-cvc6-q2cp-2xhw
Spring Security has Potential Security Misconfiguration when Using withIssuerLocation
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator. This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
- Record
GHSA-cvc6-q2cp-2xhw- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
Show 8 moreShow less
OSVCLSA-2026-1786563390No score
TuxCare security update for org.springframework.security:spring-security-oauth2-jose (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-oauth2-jose to address 1 CVE. Fixed in 6.2.7-tuxcare.3.
- Record
CLSA-2026-1786563390- Updated
- 2026-11-02
OSVCLSA-2026-1786627230No score
TuxCare security update for org.springframework.security (3 CVEs)
TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.8-tuxcare.2.
- Record
CLSA-2026-1786627230- Updated
- 2026-11-02
OSVCLSA-2026-1787157249No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 6.4.13-tuxcare.2.
- Record
CLSA-2026-1787157249- Updated
- 2026-11-02
OSVCLSA-2026-1790159292No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 9 CVEs. Fixed in 6.3.9-tuxcare.1.
- Record
CLSA-2026-1790159292- Updated
- 2026-11-02
OSVCLSA-2026-1794184822No score
TuxCare security update for org.springframework.security:spring-security-oauth2-jose (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-oauth2-jose to address 1 CVE. Fixed in 6.4.3-tuxcare.13.
- Record
CLSA-2026-1794184822- Updated
- 2026-11-09
OSVCLSA-2026-1794185565No score
TuxCare security update for org.springframework.security:spring-security-oauth2-jose (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-oauth2-jose to address 1 CVE. Fixed in 6.3.10-tuxcare.23.
- Record
CLSA-2026-1794185565- Updated
- 2026-11-09
OSVCLSA-2026-1794189800No score
TuxCare security update for org.springframework.security (14 CVEs)
TuxCare rebuilt 7 org.springframework.security packages to address 14 CVEs. Fixed in 6.1.5-tuxcare.3.
- Record
CLSA-2026-1794189800- Updated
- 2026-11-09
OSVROOT-APP-MAVEN-CVE-2026-22748No score
CVE-2026-22748 in io.root.org.springframework.security:spring-security-oauth2-jose - Patched by Root
Root has patched CVE-2026-22748 in the io.root.org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-22748- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-oauth2-joseMaven | 6.3.0 to 6.3.14 | None known |
org.springframework.security:spring-security-oauth2-joseMaven | 6.4.0 to 6.4.14 | None known |
org.springframework.security:spring-security-oauth2-joseMaven | 6.5.0 to 6.5.9 | 6.5.10 |
org.springframework.security:spring-security-oauth2-joseMaven | 7.0.0 to 7.0.4 | 7.0.5 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven | 6.2.7 up to 6.2.7-tuxcare.3, plus listed versions 6.2.7-tuxcare.16.2.7-tuxcare.2 | 6.2.7-tuxcare.3 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 3 CVEs | 6.2.8 up to 6.2.8-tuxcare.2, plus listed versions 6.2.8-tuxcare.1 | 6.2.8-tuxcare.2 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 3 CVEs | 6.2.8 up to 6.2.8-tuxcare.2, plus listed versions 6.2.8-tuxcare.1 | 6.2.8-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 3 CVEs | 6.2.8 up to 6.2.8-tuxcare.2, plus listed versions 6.2.8-tuxcare.1 | 6.2.8-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 6 CVEs | 6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 | 6.4.13-tuxcare.2 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 6 CVEs | 6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 | 6.4.13-tuxcare.2 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 6 CVEs | 6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 | 6.4.13-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 6 CVEs | 6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 | 6.4.13-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs | 6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 9 CVEs | 6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 9 CVEs | 6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs | 6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven | 6.4.3 up to 6.4.3-tuxcare.13, plus listed versions 6.4.3-tuxcare.16.4.3-tuxcare.106.4.3-tuxcare.116.4.3-tuxcare.126.4.3-tuxcare.2 Show 7 moreShow less6.4.3-tuxcare.36.4.3-tuxcare.46.4.3-tuxcare.56.4.3-tuxcare.66.4.3-tuxcare.76.4.3-tuxcare.86.4.3-tuxcare.9 | 6.4.3-tuxcare.13 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven | 6.3.10 up to 6.3.10-tuxcare.23, plus listed versions 6.3.10-tuxcare.16.3.10-tuxcare.106.3.10-tuxcare.116.3.10-tuxcare.126.3.10-tuxcare.13 Show 17 moreShow less6.3.10-tuxcare.146.3.10-tuxcare.156.3.10-tuxcare.166.3.10-tuxcare.176.3.10-tuxcare.186.3.10-tuxcare.196.3.10-tuxcare.26.3.10-tuxcare.206.3.10-tuxcare.216.3.10-tuxcare.226.3.10-tuxcare.36.3.10-tuxcare.46.3.10-tuxcare.56.3.10-tuxcare.66.3.10-tuxcare.76.3.10-tuxcare.86.3.10-tuxcare.9 | 6.3.10-tuxcare.23 |
org.springframework.security:spring-security-configTuxCare:Maven From an advisory covering 14 CVEs | 6.1.5 up to 6.1.5-tuxcare.3, plus listed versions 6.1.5-tuxcare.16.1.5-tuxcare.2 | 6.1.5-tuxcare.3 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 14 CVEs | 6.1.5 up to 6.1.5-tuxcare.3, plus listed versions 6.1.5-tuxcare.16.1.5-tuxcare.2 | 6.1.5-tuxcare.3 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 14 CVEs | 6.1.5 up to 6.1.5-tuxcare.3, plus listed versions 6.1.5-tuxcare.16.1.5-tuxcare.2 | 6.1.5-tuxcare.3 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 14 CVEs | 6.1.5 up to 6.1.5-tuxcare.3, plus listed versions 6.1.5-tuxcare.16.1.5-tuxcare.2 | 6.1.5-tuxcare.3 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 14 CVEs | 6.1.5 up to 6.1.5-tuxcare.3, plus listed versions 6.1.5-tuxcare.16.1.5-tuxcare.2 | 6.1.5-tuxcare.3 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 14 CVEs | 6.1.5 up to 6.1.5-tuxcare.3, plus listed versions 6.1.5-tuxcare.16.1.5-tuxcare.2 | 6.1.5-tuxcare.3 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 14 CVEs | 6.1.5 up to 6.1.5-tuxcare.3, plus listed versions 6.1.5-tuxcare.16.1.5-tuxcare.2 | 6.1.5-tuxcare.3 |
org.springframework.security:spring-security-oauth2-joseMaven | 6.3.0 to 6.3.14, plus listed versions 6.3.16.3.106.3.26.3.36.3.4 Show 5 moreShow less6.3.56.3.66.3.76.3.86.3.9 | None known |
org.springframework.security:spring-security-oauth2-joseMaven | 6.4.0 to 6.4.14, plus listed versions 6.4.16.4.106.4.116.4.126.4.13 Show 8 moreShow less6.4.26.4.36.4.46.4.56.4.66.4.76.4.86.4.9 | None known |
org.springframework.security:spring-security-oauth2-joseMaven | 6.5.0 up to 6.5.10, plus listed versions 6.5.16.5.26.5.36.5.46.5.5 Show 4 moreShow less6.5.66.5.76.5.86.5.9 | 6.5.10 |
org.springframework.security:spring-security-oauth2-joseMaven | 7.0.0 up to 7.0.5, plus listed versions 7.0.17.0.27.0.37.0.4 | 7.0.5 |
io.root.org.springframework.security:spring-security-oauth2-joseRoot:Maven | before 6.3.3-root.io.1 | 6.3.3-root.io.16.5.9-root.io.16.3.3-root.io.26.5.9-root.io.26.3.3-root.io.17814506986.5.9-root.io.36.5.9-root.io.46.5.9-root.io.5 |
org.springframework.security:spring-security-oauth2-joseRoot:Maven | before 6.3.3-aikido.2 | 6.3.3-aikido.26.5.9-aikido.26.3.3-aikido.17814506986.5.9-aikido.36.5.9-aikido.46.5.9-aikido.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, facts | ||
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-22748 is a medium vulnerability (CVSS 5.3) in Spring Security, published April 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in org.springframework.security:spring-security-oauth2-jose 6.5.10.