What is the CVSS score of CVE-2026-22748?

CVE-2026-22748 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-22748?

Yes, a patch is available for CVE-2026-22748. Update the affected software to the latest version immediately.

Spring Security CVE-2026-22748

EUVD-2026-24610 MEDIUM

Improper Input Validation (CWE-20)

2026-04-22 vmware

GHSA-cvc6-q2cp-2xhw

Information Disclosure Java Red Hat

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 06:30 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 06:00 euvd

EUVD-2026-24610

Analysis Generated

Apr 22, 2026 - 06:00 vuln.today

CVE Published

Apr 22, 2026 - 05:15 nvd

MEDIUM 5.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

74 maven packages depend on org.springframework.security:spring-security-oauth2-jose (17 direct, 57 indirect)

Ecosystem-wide dependent count for version 6.3.0.

DescriptionCVE.org

Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

AnalysisAI

JWT token validation bypass in Spring Security allows authenticated attackers to forge or manipulate JWT tokens when NimbusJwtDecoder or NimbusReactiveJwtDecoder is used without explicit OAuth2TokenValidator configuration, enabling unauthorized access to protected resources. The vulnerability affects Spring Security versions 6.3.0-6.3.14, 6.4.0-6.4.14, 6.5.0-6.5.9, and 7.0.0-7.0.4. CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) reflects network-accessible exploitation requiring low-privilege authentication and high attack complexity.

Technical ContextAI

Spring Security's NimbusJwtDecoder and NimbusReactiveJwtDecoder are responsible for decoding and validating JSON Web Tokens (JWTs) in OAuth2/OpenID Connect flows. JWT validation requires two distinct steps: cryptographic signature verification (performed by the decoder) and semantic/business-logic validation (performed by an OAuth2TokenValidator implementation). When an application instantiates the decoder without explicitly calling setJwtValidator() to attach a custom validator, the decoder may skip critical validation checks such as issuer verification, audience claim validation, expiration enforcement, or scope validation. This omission allows attackers with valid credentials to the OAuth2 provider to craft or replay tokens that bypass application-level authorization logic, even though the signature itself remains valid. The root cause is a configuration-dependent trust model where secure defaults are not enforced, placing the burden entirely on developers to remember additional configuration steps.

RemediationAI

Upgrade Spring Security to patched versions: 6.3.15 or later for the 6.3 branch, 6.4.15 or later for the 6.4 branch, 6.5.10 or later for the 6.5 branch, or 7.0.5 or later for the 7.0 branch. For applications unable to upgrade immediately, explicitly configure an OAuth2TokenValidator<Jwt> for every NimbusJwtDecoder or NimbusReactiveJwtDecoder instance by calling setJwtValidator() with a validator that enforces issuer, audience, expiration, and scope validation appropriate to your OAuth2 provider. Example: decoder.setJwtValidator(new DelegatingOAuth2TokenValidator<>(new JwtTimestampValidator(), new JwtIssuerValidator(expectedIssuer), new JwtClaimValidator<String>("aud", audience::equals))). This workaround ensures semantic validation is not skipped, though upgrading is strongly preferred. Refer to Spring Security documentation at https://spring.io/security/cve-2026-22748 for detailed remediation guidance.