PT-2026-34252 · Spring · Spring Security

Published 2026-04-22 · Updated 2026-05-25 · CVE-2026-22748

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spring Spring Security versions 6.3.0 through 6.3.14 Spring Spring Security versions 6.4.0 through 6.4.14 Spring Spring Security versions 6.5.0 through 6.5.9 Spring Spring Security versions 7.0.0 through 7.0.4

Description An issue exists when an application configures JWT decoding using NimbusJwtDecoder or NimbusReactiveJwtDecoder. In these cases, an OAuth2TokenValidator<Jwt> must be configured separately, such as by calling the setJwtValidator function.

Recommendations For versions 6.3.0 through 6.3.14, configure an OAuth2TokenValidator<Jwt> separately by calling setJwtValidator when using NimbusJwtDecoder or NimbusReactiveJwtDecoder. For versions 6.4.0 through 6.4.14, configure an OAuth2TokenValidator<Jwt> separately by calling setJwtValidator when using NimbusJwtDecoder or NimbusReactiveJwtDecoder. For versions 6.5.0 through 6.5.9, configure an OAuth2TokenValidator<Jwt> separately by calling setJwtValidator when using NimbusJwtDecoder or NimbusReactiveJwtDecoder. For versions 7.0.0 through 7.0.4, configure an OAuth2TokenValidator<Jwt> separately by calling setJwtValidator when using NimbusJwtDecoder or NimbusReactiveJwtDecoder.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-22748

GHSA-CVC6-Q2CP-2XHW

Affected Products

Spring Security

References · 6

• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-22748 · Vendor Advisory
• https://spring.io/security/cve-2026-22748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22748 · Security Note
• https://osv.dev/vulnerability/GHSA-cvc6-q2cp-2xhw · Vendor Advisory
• https://github.com/spring-projects/spring-security · Note
• https://twitter.com/CVEnew/status/2047428159126265857 · Twitter Post