PT-2026-34042 · Spring · Spring Security

Jinyeong Seol + 1 · Published 2026-04-21 · Updated 2026-05-01 · CVE-2026-22751

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Spring Spring Security versions 6.4.0 through 6.4.15 Spring Spring Security versions 6.5.0 through 6.5.9 Spring Spring Security versions 7.0.0 through 7.0.4

Description Applications that explicitly configure One-Time Token login using JdbcOneTimeTokenService are subject to a Time-of-check Time-of-use (TOCTOU) race condition. A TOCTOU race condition occurs when a program checks the state of a resource and then performs an action based on that state, but the state changes between the check and the action.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-22751

GHSA-X2WQ-9X2F-FHJ7

Affected Products

Spring Security

References · 9

• https://spring.io/security/cve-2026-22751 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x2wq-9x2f-fhj7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22751 · Security Note
• https://github.com/spring-projects/spring-security/commit/4187af38b251fc97fdf9949f7869618111e6e261 · Note
• https://github.com/spring-projects/spring-security · Note
• https://github.com/spring-projects/spring-security/commit/163772775036c4146815a5266874278c6f45f047 · Note
• https://twitter.com/CVEnew/status/2046674991769321814 · Twitter Post
• https://t.me/cveNotify/161708 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2046776686289576428 · Twitter Post