Home

Description

Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

PUBLISHED Reserved 2026-01-09 | Published 2026-04-22 | Updated 2026-04-22 | Assigner vmware




MEDIUM: 5.3CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Product status

Default status
unaffected

6.3.0 (custom)
affected

6.4.0 (custom)
affected

6.5.0 (custom)
affected

7.0.0 (custom)
affected

References

spring.io/security/cve-2026-22748

cve.org (CVE-2026-22748)

nvd.nist.gov (CVE-2026-22748)

Download JSON