What is the CVSS score of EUVD-2026-24227?

EUVD-2026-24227 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-24227?

Yes, a patch is available for EUVD-2026-24227. Update the affected software to the latest version immediately.

Spring Security EUVD-2026-24227

| CVE-2026-22751 MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-04-21 vmware

GHSA-x2wq-9x2f-fhj7

Information Disclosure Java

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Red Hat

4.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 21, 2026 - 19:47 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 19:00 euvd

EUVD-2026-24227

Analysis Generated

Apr 21, 2026 - 19:00 vuln.today

CVE Published

Apr 21, 2026 - 18:30 nvd

MEDIUM 4.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1,207 maven packages depend on org.springframework.security:spring-security-core (472 direct, 735 indirect)

Ecosystem-wide dependent count for version 6.5.0.

DescriptionCVE.org

Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

AnalysisAI

Time-of-check Time-of-use (TOCTOU) race condition in Spring Security's JdbcOneTimeTokenService allows unauthenticated remote attackers to bypass one-time token validation and gain unauthorized access. Affected versions include 6.4.0-6.4.15, 6.5.0-6.5.9, and 7.0.0-7.0.4. The vulnerability requires explicit configuration of One-Time Token login and involves high attack complexity, limiting real-world exploitation despite network accessibility.

Technical ContextAI

Spring Security's JdbcOneTimeTokenService implements one-time token (OTT) authentication by validating tokens stored in a relational database before marking them as consumed. The TOCTOU race condition occurs in the window between token validation (time-of-check) and token invalidation (time-of-use), allowing an attacker to exploit concurrent requests to reuse the same token multiple times. This is rooted in CWE-367 (Improper Restriction of Rendered UI Layers in a Multi-tier Architecture), indicating insufficient synchronization or atomic operations during the validate-then-consume sequence. The vulnerability affects applications using Spring Security's JDBC-backed token storage mechanism for passwordless authentication flows.

RemediationAI

Upgrade Spring Security to version 6.4.16 or later (6.4.x branch), 6.5.10 or later (6.5.x branch), or 7.0.5 or later (7.0.x branch). If immediate upgrade is not possible, disable JdbcOneTimeTokenService and switch to alternative authentication mechanisms (e.g., session-based authentication, OAuth2 with refresh tokens, or hardware tokens) until patching is feasible. As a temporary mitigation, implement database-level constraints to enforce token single-use semantics (unique constraint on consumed timestamp or consumed_at field) and configure connection pooling with transaction isolation level set to SERIALIZABLE for token validation operations; note that SERIALIZABLE isolation may impact performance under high concurrency. Review Spring Security advisory at https://spring.io/security/cve-2026-22751 for confirmation and additional guidance.