{"id":"CVE-2026-22748","aliases":["CLSA-2026-1786563390","CLSA-2026-1786627230","CLSA-2026-1787157249","CLSA-2026-1790159292","CLSA-2026-1794184822","CLSA-2026-1794185565","CLSA-2026-1794189800","EUVD-2026-24610","GHSA-cvc6-q2cp-2xhw","ROOT-APP-MAVEN-CVE-2026-22748"],"status":"published","title":"Potential Security Misconfiguration when Using withIssuerLocation","description":"Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator\u003cJwt\u003e separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00203,"percentile":0.1035,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2026-04-22T05:15:03Z","modified":"2026-11-09T07:15:05Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.security:spring-security-oauth2-jose","fixed_in":["6.5.10","7.0.5"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-jose","fixed_in":["6.2.7-tuxcare.3","6.4.3-tuxcare.13","6.3.10-tuxcare.23"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-oauth2-jose","fixed_in":["6.3.3-root.io.1","6.5.9-root.io.1","6.3.3-root.io.2","6.5.9-root.io.2","6.3.3-root.io.1781450698","6.5.9-root.io.3","6.5.9-root.io.4","6.5.9-root.io.5"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-oauth2-jose","fixed_in":["6.3.3-aikido.2","6.5.9-aikido.2","6.3.3-aikido.1781450698","6.5.9-aikido.3","6.5.9-aikido.4","6.5.9-aikido.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.0"},{"last_affected":"6.3.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"last_affected":"6.4.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.0"},{"last_affected":"6.5.9"},{"fixed":"6.5.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.4"},{"fixed":"7.0.5"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.3"}]}],"versions":["6.2.7","6.2.7-tuxcare.1","6.2.7-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.8"},{"fixed":"6.2.8-tuxcare.2"}]}],"versions":["6.2.8","6.2.8-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.8"},{"fixed":"6.2.8-tuxcare.2"}]}],"versions":["6.2.8","6.2.8-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.8"},{"fixed":"6.2.8-tuxcare.2"}]}],"versions":["6.2.8","6.2.8-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.13"},{"fixed":"6.4.13-tuxcare.2"}]}],"versions":["6.4.13","6.4.13-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.13"},{"fixed":"6.4.13-tuxcare.2"}]}],"versions":["6.4.13","6.4.13-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.13"},{"fixed":"6.4.13-tuxcare.2"}]}],"versions":["6.4.13","6.4.13-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.13"},{"fixed":"6.4.13-tuxcare.2"}]}],"versions":["6.4.13","6.4.13-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.9"},{"fixed":"6.3.9-tuxcare.1"}]}],"versions":["6.3.9"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.9"},{"fixed":"6.3.9-tuxcare.1"}]}],"versions":["6.3.9"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.9"},{"fixed":"6.3.9-tuxcare.1"}]}],"versions":["6.3.9"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.9"},{"fixed":"6.3.9-tuxcare.1"}]}],"versions":["6.3.9"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.13"}]}],"versions":["6.4.3","6.4.3-tuxcare.1","6.4.3-tuxcare.10","6.4.3-tuxcare.11","6.4.3-tuxcare.12","6.4.3-tuxcare.2","6.4.3-tuxcare.3","6.4.3-tuxcare.4","6.4.3-tuxcare.5","6.4.3-tuxcare.6","6.4.3-tuxcare.7","6.4.3-tuxcare.8","6.4.3-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.10"},{"fixed":"6.3.10-tuxcare.23"}]}],"versions":["6.3.10","6.3.10-tuxcare.1","6.3.10-tuxcare.10","6.3.10-tuxcare.11","6.3.10-tuxcare.12","6.3.10-tuxcare.13","6.3.10-tuxcare.14","6.3.10-tuxcare.15","6.3.10-tuxcare.16","6.3.10-tuxcare.17","6.3.10-tuxcare.18","6.3.10-tuxcare.19","6.3.10-tuxcare.2","6.3.10-tuxcare.20","6.3.10-tuxcare.21","6.3.10-tuxcare.22","6.3.10-tuxcare.3","6.3.10-tuxcare.4","6.3.10-tuxcare.5","6.3.10-tuxcare.6","6.3.10-tuxcare.7","6.3.10-tuxcare.8","6.3.10-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.0"},{"last_affected":"6.3.14"}]}],"versions":["6.3.0","6.3.1","6.3.10","6.3.2","6.3.3","6.3.4","6.3.5","6.3.6","6.3.7","6.3.8","6.3.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"last_affected":"6.4.14"}]}],"versions":["6.4.0","6.4.1","6.4.10","6.4.11","6.4.12","6.4.13","6.4.2","6.4.3","6.4.4","6.4.5","6.4.6","6.4.7","6.4.8","6.4.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.0"},{"fixed":"6.5.10"}]}],"versions":["6.5.0","6.5.1","6.5.2","6.5.3","6.5.4","6.5.5","6.5.6","6.5.7","6.5.8","6.5.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.5"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.3","7.0.4"]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.3-root.io.1"},{"fixed":"6.5.9-root.io.1"},{"fixed":"6.3.3-root.io.2"},{"fixed":"6.5.9-root.io.2"},{"fixed":"6.3.3-root.io.1781450698"},{"fixed":"6.5.9-root.io.3"},{"fixed":"6.5.9-root.io.4"},{"fixed":"6.5.9-root.io.5"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.3-aikido.2"},{"fixed":"6.5.9-aikido.2"},{"fixed":"6.3.3-aikido.1781450698"},{"fixed":"6.5.9-aikido.3"},{"fixed":"6.5.9-aikido.4"},{"fixed":"6.5.9-aikido.5"}]}]}],"products":[{"vendor":"spring","product":"spring security"},{"vendor":"vmware","product":"spring_security"}],"references":[{"url":"https://spring.io/security/cve-2026-22748","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22748","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cvc6-q2cp-2xhw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22748.json","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-security","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-22748","title":"Potential Security Misconfiguration when Using withIssuerLocation","description":"Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator\u003cJwt\u003e separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.","status":"published","published":"2026-04-22T05:15:03.505Z","modified":"2026-04-22T16:00:09.573Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T13:39:05.585774Z"}],"euvd":[{"id":"EUVD-2026-24610","description":"Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator\u003cJwt\u003e separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.","status":"published","published":"2026-04-22T05:15:03Z","modified":"2026-04-22T16:00:09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:20.283712Z"}],"ghsa":[{"id":"GHSA-cvc6-q2cp-2xhw","title":"Spring Security has Potential Security Misconfiguration when Using withIssuerLocation","description":"Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator\u003cJwt\u003e separately, for example by calling setJwtValidator. This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.","status":"published","published":"2026-04-22T06:30:29Z","modified":"2026-04-29T20:48:40Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:39:59.776263Z"}],"nvd":[{"id":"CVE-2026-22748","description":"Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator\u003cJwt\u003e separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.","status":"published","published":"2026-04-22T06:16:04.04Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:15.493943Z"}],"osv":[{"id":"CVE-2026-22748","title":"Potential Security Misconfiguration when Using withIssuerLocation","description":"Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator\u003cJwt\u003e separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.","status":"published","published":"2026-04-22T05:15:03.505Z","modified":"2026-10-28T02:30:21.390565512Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"GHSA-cvc6-q2cp-2xhw","title":"Spring Security has Potential Security Misconfiguration when Using withIssuerLocation","description":"Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator\u003cJwt\u003e separately, for example by calling setJwtValidator. This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.","status":"published","published":"2026-04-22T06:30:29Z","modified":"2026-09-10T03:50:44.1284539Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"CLSA-2026-1786563390","title":"TuxCare security update for org.springframework.security:spring-security-oauth2-jose (1 CVE)","description":"TuxCare rebuilt org.springframework.security:spring-security-oauth2-jose to address 1 CVE. Fixed in 6.2.7-tuxcare.3.","status":"published","published":"2026-08-12T19:36:30Z","modified":"2026-10-30T07:30:36.142694277Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1786627230","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.8-tuxcare.2.","status":"published","published":"2026-08-13T13:20:30Z","modified":"2026-11-02T19:45:55.884211941Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1787157249","title":"TuxCare security update for org.springframework.security (6 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 6.4.13-tuxcare.2.","status":"published","published":"2026-08-19T16:34:09Z","modified":"2026-11-02T19:45:56.682102632Z","updated_at":"2026-11-02T20:29:49.757752Z"},{"id":"CLSA-2026-1790159292","title":"TuxCare security update for org.springframework.security (9 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 9 CVEs. Fixed in 6.3.9-tuxcare.1.","status":"published","published":"2026-09-23T10:28:12Z","modified":"2026-11-02T19:46:21.768639219Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"CLSA-2026-1794184822","title":"TuxCare security update for org.springframework.security:spring-security-oauth2-jose (1 CVE)","description":"TuxCare rebuilt org.springframework.security:spring-security-oauth2-jose to address 1 CVE. Fixed in 6.4.3-tuxcare.13.","status":"published","published":"2026-11-09T01:40:23Z","modified":"2026-11-09T07:15:05.221420449Z","updated_at":"2026-11-09T07:20:29.20536Z"},{"id":"CLSA-2026-1794185565","title":"TuxCare security update for org.springframework.security:spring-security-oauth2-jose (1 CVE)","description":"TuxCare rebuilt org.springframework.security:spring-security-oauth2-jose to address 1 CVE. Fixed in 6.3.10-tuxcare.23.","status":"published","published":"2026-11-09T01:52:46Z","modified":"2026-11-09T07:15:04.227043139Z","updated_at":"2026-11-09T07:20:29.20536Z"},{"id":"CLSA-2026-1794189800","title":"TuxCare security update for org.springframework.security (14 CVEs)","description":"TuxCare rebuilt 7 org.springframework.security packages to address 14 CVEs. Fixed in 6.1.5-tuxcare.3.","status":"published","published":"2026-11-09T03:03:20Z","modified":"2026-11-09T07:15:04.228555714Z","updated_at":"2026-11-09T07:20:29.20536Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-22748","title":"CVE-2026-22748 in io.root.org.springframework.security:spring-security-oauth2-jose - Patched by Root","description":"Root has patched CVE-2026-22748 in the io.root.org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-07-29T14:49:52Z","modified":"2026-07-29T19:00:12.932709257Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}