{"id":"CVE-2024-22258","aliases":["CLSA-2026-1768522124","EUVD-2024-1035","GHSA-x637-x8p3-5p22","ROOT-APP-MAVEN-CVE-2024-22258","UBUNTU-CVE-2024-22258"],"status":"published","title":"CVE-2024-22258: PKCE Downgrade in Spring Authorization Server","description":"Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.\n\nSpecifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant.\n\nAn application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00526,"percentile":0.44859,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-470"],"published":"2024-03-20T03:58:13Z","modified":"2026-10-17T12:56:29Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.security:spring-security-oauth2-authorization-server","fixed_in":["1.1.6","1.2.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-authorization-server","fixed_in":["1.1.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-oauth2-authorization-server","fixed_in":["1.2.0-root.io.1","1.2.0-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-oauth2-authorization-server","fixed_in":["1.2.0-aikido.1","1.2.0-aikido.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-oauth2-authorization-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-oauth2-authorization-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.3"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-authorization-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.4"},{"fixed":"1.1.4-tuxcare.1"}]}],"versions":["1.1.4"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-oauth2-authorization-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6"}]}],"versions":["0.2.0","0.2.1","0.2.2","0.2.3","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-oauth2-authorization-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.3"}]}],"versions":["1.2.0","1.2.1","1.2.2"]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-oauth2-authorization-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-root.io.1"},{"fixed":"1.2.0-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-oauth2-authorization-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-aikido.1"},{"fixed":"1.2.0-aikido.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["100.0+dfsg-2","100.0+dfsg-2build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["103.0+dfsg2-1","103.0+dfsg2-1build1","104.0+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["104.0+dfsg-3build2","104.0+dfsg-4ubuntu1","104.0+dfsg-4ubuntu2","104.0+dfsg-4ubuntu5","104.0+dfsg-4ubuntu6","104.0+dfsg-4ubuntu7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["105.0.1+dfsg-2","105.0.1+dfsg-3ubuntu1","105.0.1+dfsg-3ubuntu2","105.0.1+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["106.0+dfsg-2","106.0+dfsg-3","106.0+dfsg-3build2","106.0+dfsg-3build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["106.0+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["106.0+dfsg-4","106.0+dfsg-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["106.0+dfsg-4"]}],"products":[{"vendor":"spring","product":"spring"},{"vendor":"vmware","product":"spring"}],"references":[{"url":"https://spring.io/security/cve-2024-22258","tags":["x_transferred","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22258","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-authorization-server/commit/a7035d22bd2de6c24e7125623d38fb83d8f659a9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x637-x8p3-5p22"},{"url":"github.com/spring-projects/spring-authorization-server","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-22258","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22258","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-22258","title":"CVE-2024-22258: PKCE Downgrade in Spring Authorization Server","description":"Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.\n\nSpecifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant.\n\nAn application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.\n\n","status":"published","published":"2024-03-20T03:58:13.125Z","modified":"2024-12-05T20:31:25.882Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T14:34:00.254134Z"}],"euvd":[{"id":"EUVD-2024-1035","description":"Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.\n\nSpecifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant.\n\nAn application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.\n\n","status":"published","published":"2024-03-20T03:58:13Z","modified":"2024-12-05T20:31:25Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:39.661841Z"}],"ghsa":[{"id":"GHSA-x637-x8p3-5p22","title":"Improper Authentication in Spring Authorization Server","description":"Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.\n\nSpecifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant.\n\nAn application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.\n\n","status":"published","published":"2024-03-20T15:32:28Z","modified":"2024-12-05T22:18:00Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287","CWE-470"],"updated_at":"2026-11-02T14:38:24.542211Z"}],"nvd":[{"id":"CVE-2024-22258","description":"Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.\n\nSpecifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant.\n\nAn application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.\n\n","status":"published","published":"2024-03-20T04:15:08.6Z","modified":"2026-06-17T07:11:02.923Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T14:09:41.654534Z"}],"osv":[{"id":"GHSA-x637-x8p3-5p22","title":"Improper Authentication in Spring Authorization Server","description":"Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.\n\nSpecifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant.\n\nAn application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.\n\n","status":"published","published":"2024-03-20T15:32:28Z","modified":"2024-12-05T22:24:50.094223Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287","CWE-470"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"UBUNTU-CVE-2024-22258","description":"Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients. Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant. An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.","status":"published","published":"2024-03-20T04:15:00Z","modified":"2026-10-17T12:56:29.555197075Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"CLSA-2026-1768522124","title":"TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (1 CVE)","description":"TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.1.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-15T09:46:05.941904767Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"ROOT-APP-MAVEN-CVE-2024-22258","title":"CVE-2024-22258 in io.root.org.springframework.security:spring-security-oauth2-authorization-server - Patched by Root","description":"Root has patched CVE-2024-22258 in the io.root.org.springframework.security:spring-security-oauth2-authorization-server package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-07-29T12:38:48Z","modified":"2026-07-29T19:00:14.147037082Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}