Spring Authorization Server CVE-2026-22752

Exploitation requires the affected component to be Spring Authorization Server running one of the listed versions (7.0.0-7.0.4, 1.5.0-1.5.6, 1.4.0-1.4.9, or 1.3.0-1.3.10) and reachable over the network (AV:N). Per the CVSS vector, the attacker must be authenticated at a low privilege level (PR:L) - for example, possessing a valid low-tier user account or an enrolled OAuth client - so this is not a fully unauthenticated bypass; no user interaction is needed (UI:N) and complexity is low (AC:L). The primary limiting factor is that PR:L precondition: environments that do not expose the authorization server to lower-trust authenticated actors have a materially smaller attack surface. The exact feature, endpoint, or configuration that triggers the bypass is not specified in the provided data (no CWE and only a summary description), so the precise triggering condition must be confirmed against the spring.io advisory.

The signals largely align toward genuine priority: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with a scope change that lets impact cross from the authorization server into the protected systems it fronts. However, PR:L means this is not a fully pre-authentication flaw - the attacker must first hold some low-level authenticated context (e.g., a valid low-privilege account or client credential), which meaningfully raises the bar versus a PR:N bypass. Countervailing data is thin: no EPSS score, KEV status, POC, or SVCC/SSVC decision data was supplied, so exploitation likelihood cannot be quantified and should not be assumed high despite the 9.6 base score. The absence of a CWE and of granular vendor detail means the exact bypass mechanism is unconfirmed from the provided data - verify specifics against the spring.io advisory before finalizing exposure conclusions.

An attacker who already holds a low-privilege credential or registered client on the affected Spring Authorization Server sends crafted requests to the authentication/authorization flow to bypass the intended authentication check. Leveraging the scope change, they obtain access to protected resources or tokens they should not be entitled to, compromising confidentiality and integrity of downstream resource servers. No public exploit code is identified at time of analysis, and the low attack complexity means a working exploit, once developed, would be reliable.