CVE-2026-22748

Опубликовано: 22 апр. 2026

Источник: nvd

CVSS3: 5.3

CVSS3: 6.5

EPSS Низкий

Описание

Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

Ссылки

https://spring.io/security/cve-2026-22748
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*

Версия до 6.3.15 (исключая)

cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*

Версия от 6.4.0 (включая) до 6.4.15 (исключая)

cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*

Версия от 6.5.0 (включая) до 6.5.10 (исключая)

cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*

Версия от 7.0.0 (включая) до 7.0.5 (исключая)

EPSS

Процентиль: 11%

0.00203

Низкий

5.3 Medium

CVSS3

6.5 Medium

CVSS3

Дефекты

CWE-20

Связанные уязвимости

CVE-2026-22748

CVSS3: 5.3

ubuntu

4 месяца назад

Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

CVE-2026-22748

CVSS3: 5.3

redhat

4 месяца назад

Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

CVE-2026-22748

CVSS3: 5.3

debian

4 месяца назад

Vulnerability in Spring Spring Security. When an application configure ...

GHSA-cvc6-q2cp-2xhw

CVSS3: 5.3

github

4 месяца назад

Spring Security has Potential Security Misconfiguration when Using withIssuerLocation

EPSS

Процентиль: 11%

0.00203

Низкий

5.3 Medium

CVSS3

6.5 Medium

CVSS3

Дефекты

CWE-20