CVE-2026-22748
published 2026-04-22CVE-2026-22748: Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.20%
10.4th percentile
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| jenkins | jenkins | — | — |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
| spring | spring_security | 6.3.0 – 6.3.14 | — |
| spring | spring_security | 6.4.0 – 6.4.14 | — |
| spring | spring_security | 6.5.0 – 6.5.9 | — |
| spring | spring_security | 7.0.0 – 7.0.4 | — |
| vmware | spring_security | < 6.3.15 | 6.3.15 |
| vmware | spring_security | >= 6.4.0 < 6.4.15 | 6.4.15 |
| vmware | spring_security | >= 6.5.0 < 6.5.10 | 6.5.10 |
| vmware | spring_security | >= 7.0.0 < 7.0.5 | 7.0.5 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cvc6-q2cp-2xhw: Vulnerability in Spring Spring Security
ghsa_unreviewed·2026-04-22
CVE-2026-22748 [MEDIUM] CWE-20 GHSA-cvc6-q2cp-2xhw: Vulnerability in Spring Spring Security
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
GHSA
Spring Security has Potential Security Misconfiguration when Using withIssuerLocation
ghsa·2026-04-22
CVE-2026-22748 [MEDIUM] CWE-20 Spring Security has Potential Security Misconfiguration when Using withIssuerLocation
Spring Security has Potential Security Misconfiguration when Using withIssuerLocation
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator. This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Red Hat
Spring Security: Spring Security: Integrity impact due to improper JSON Web Token (JWT) validation
vendor_redhat·2026-04-22·CVSS 5.3
CVE-2026-22748 [MEDIUM] CWE-347 Spring Security: Spring Security: Integrity impact due to improper JSON Web Token (JWT) validation
Spring Security: Spring Security: Integrity impact due to improper JSON Web Token (JWT) validation
A flaw was found in Spring Security. When an application is configured to decode JSON Web Tokens (JWTs) using `NimbusJwtDecoder` or `NimbusReactiveJwtDecoder`, it may not properly validate these tokens if an `OAuth2TokenValidator` is not explicitly configured. This oversight could allow an attacker with low privileges to bypass security checks, potentially leading to unauthorized actions or data manipulation within the application.
Mitigation: To mitigate this issue, applications using Spring Security's `NimbusJwtDecoder` or `NimbusReactiveJwtDecoder` must explicitly configure an `OAuth2TokenValidator`. This ensures proper validation of JSON Web Tokens, preventing unauthorized access or dat
No detection rules found.
No public exploits indexed.
2026-04-22
Published