CVE-2026-22751
published 2026-04-21CVE-2026-22751: Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a…
PriorityP423medium4.8CVSS 3.1
AVNACHPRNUINSUCLILAN
EPSS
0.12%
2.6th percentile
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| jenkins | jenkins | — | — |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
| spring | spring_security | 6.4.0 – 6.4.15 | — |
| spring | spring_security | 6.5.0 – 6.5.9 | — |
| spring | spring_security | 7.0.0 – 7.0.4 | — |
| vmware | spring_security | >= 6.4.0 < 6.4.16 | 6.4.16 |
| vmware | spring_security | >= 6.5.0 < 6.5.10 | 6.5.10 |
| vmware | spring_security | >= 7.0.0 < 7.0.5 | 7.0.5 |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
vendor_redhat4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured
ghsa·2026-04-21
CVE-2026-22751 [MEDIUM] CWE-367 Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured
Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
VulDB
Vmware Spring Security up to 6.4.15/6.5.9/7.0.4 One-Time Token Login toctou (EUVD-2026-24227)
vuldb·2026-04-21·CVSS 4.8
CVE-2026-22751 [MEDIUM] Vmware Spring Security up to 6.4.15/6.5.9/7.0.4 One-Time Token Login toctou (EUVD-2026-24227)
A vulnerability was found in Vmware Spring Security up to 6.4.15/6.5.9/7.0.4. It has been classified as problematic. This vulnerability affects unknown code of the component One-Time Token Login. The manipulation leads to time-of-check time-of-use.
This vulnerability is traded as CVE-2026-22751. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is recommended.
GHSA
GHSA-x2wq-9x2f-fhj7: Vulnerability in Spring Spring Security
ghsa_unreviewed·2026-04-21
CVE-2026-22751 [MEDIUM] CWE-367 GHSA-x2wq-9x2f-fhj7: Vulnerability in Spring Spring Security
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Red Hat
Spring Security: JdbcOneTimeTokenService: Spring Security: Authentication bypass due to race condition in One-Time Token login
vendor_redhat·2026-04-21·CVSS 4.8
CVE-2026-22751 [MEDIUM] CWE-367 Spring Security: JdbcOneTimeTokenService: Spring Security: Authentication bypass due to race condition in One-Time Token login
Spring Security: JdbcOneTimeTokenService: Spring Security: Authentication bypass due to race condition in One-Time Token login
A flaw was found in Spring Security, specifically in applications configured for One-Time Token login using JdbcOneTimeTokenService. This vulnerability is due to a Time-of-check Time-of-use (TOCTOU) race condition. A remote attacker with high attack complexity could exploit this flaw to achieve low confidentiality and low integrity impact, potentially leading to unauthorized access or limited information disclosure.
Package: jenkins (OpenShift Developer Tools and Services) - Fix deferred
Package: ocp-tools-4/jenkins-rhel8 (OpenShift Developer Tools and Services) - Fix deferred
Package: ocp-tools-4/jenkins-rhel9 (OpenShift Developer Tools and Services) - Fix def
No detection rules found.
No public exploits indexed.
2026-04-21
Published