{"id":"CVE-2026-22752","aliases":["CLSA-2026-1788528946","CLSA-2026-1792128363","CLSA-2026-1792160409","EUVD-2026-44904","GHSA-h9v6-4cv4-ghhq"],"status":"published","title":"Spring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of client metadata","description":"Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server.\n\nThis issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00479,"percentile":0.41611,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2026-07-16T08:40:23Z","modified":"2026-10-28T02:30:30Z","fixes":[{"ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-authorization-server","fixed_in":["1.3.7-tuxcare.6","1.3.6-tuxcare.1","1.4.8-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-authorization-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.7"},{"fixed":"1.3.7-tuxcare.6"}]}],"versions":["1.3.7","1.3.7-tuxcare.1","1.3.7-tuxcare.2","1.3.7-tuxcare.3","1.3.7-tuxcare.4","1.3.7-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-authorization-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.6"},{"fixed":"1.3.6-tuxcare.1"}]}],"versions":["1.3.6"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-authorization-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.8"},{"fixed":"1.4.8-tuxcare.1"}]}],"versions":["1.4.8"]}],"products":[{"vendor":"broadcom","product":"spring_authorization_server"},{"vendor":"spring","product":"spring authorization server"},{"vendor":"spring security","product":"spring authorization server"}],"references":[{"url":"https://spring.io/security/cve-2026-22752","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22752","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h9v6-4cv4-ghhq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22752.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-22752","title":"Spring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of client metadata","description":"Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server.\n\nThis issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.","status":"published","published":"2026-07-16T08:40:23.009Z","modified":"2026-07-21T14:09:17.046Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:39:05.585774Z"}],"euvd":[{"id":"EUVD-2026-44904","description":"Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server.\n\nThis issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.","status":"published","published":"2026-07-16T08:40:23Z","modified":"2026-07-21T14:09:17Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T18:19:47.436242Z"}],"ghsa":[{"id":"GHSA-h9v6-4cv4-ghhq","title":"Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization...","description":"Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server.\n\nThis issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.","status":"published","published":"2026-07-16T12:32:28Z","modified":"2026-07-21T15:31:35Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:09:37.555146Z"}],"nvd":[{"id":"CVE-2026-22752","description":"Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server.\n\nThis issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.","status":"published","published":"2026-07-16T10:16:24.767Z","modified":"2026-10-24T21:10:00.13Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:30.250437Z"}],"osv":[{"id":"CVE-2026-22752","title":"Spring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of client metadata","description":"Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server.\n\nThis issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.","status":"published","published":"2026-07-16T08:40:23.009Z","modified":"2026-10-28T02:30:30.473439462Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"CLSA-2026-1788528946","title":"TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (1 CVE)","description":"TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.3.7-tuxcare.6.","status":"published","published":"2026-09-04T13:35:46Z","modified":"2026-10-15T09:47:33.843701878Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1792128363","title":"TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (1 CVE)","description":"TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.3.6-tuxcare.1.","status":"published","published":"2026-10-16T05:26:03Z","modified":"2026-10-16T07:00:02.269818341Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792160409","title":"TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (1 CVE)","description":"TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.4.8-tuxcare.1.","status":"published","published":"2026-10-16T14:20:09Z","modified":"2026-10-16T16:30:03.253732696Z","updated_at":"2026-11-02T15:43:50.949147Z"}]}}