Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-22751

Опубликовано: 21 апр. 2026
Источник: redhat
CVSS3: 4.8

Описание

Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

A flaw was found in Spring Security, specifically in applications configured for One-Time Token login using JdbcOneTimeTokenService. This vulnerability is due to a Time-of-check Time-of-use (TOCTOU) race condition. A remote attacker with high attack complexity could exploit this flaw to achieve low confidentiality and low integrity impact, potentially leading to unauthorized access or limited information disclosure.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
OpenShift Developer Tools and ServicesjenkinsFix deferred
OpenShift Developer Tools and Servicesocp-tools-4/jenkins-rhel8Fix deferred
OpenShift Developer Tools and Servicesocp-tools-4/jenkins-rhel9Fix deferred
Red Hat build of Apache Camel for Spring Boot 4spring-security-coreFix deferred
Red Hat build of Apache Camel - HawtIO 4spring-security-coreFix deferred
Red Hat build of Quarkusquarkus-spring-security-core-apiFix deferred
Red Hat Data Grid 8spring-security-coreFix deferred
Red Hat Fuse 7org.apache.servicemix.bundles.spring-security-coreFix deferred
Red Hat Fuse 7spring-security-coreFix deferred
Red Hat JBoss Enterprise Application Platform 7spring-security-coreFix deferred

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-367
https://bugzilla.redhat.com/show_bug.cgi?id=2460211Spring Security: JdbcOneTimeTokenService: Spring Security: Authentication bypass due to race condition in One-Time Token login

4.8 Medium

CVSS3

Связанные уязвимости

CVSS3: 4.8
ubuntu
4 месяца назад

Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

CVSS3: 4.8
nvd
4 месяца назад

Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

CVSS3: 4.8
debian
4 месяца назад

Vulnerability in Spring Spring Security. Applications that explicitly ...

CVSS3: 4.8
github
4 месяца назад

Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured

4.8 Medium

CVSS3