CVE-2026-22751 Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions

🗓️ 21 Apr 2026 18:30:35Reported by GoogleType

osv🔗 osv.dev👁 1 Views

Spring Security JdbcOneTimeTokenService may allow a one-time token to authenticate multiple sessions due to a race.

Reporter	Title	Published	Views	Family All 41
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-2026-22751)	15 Jun 202620:41	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	1 Jun 202608:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	24 May 202615:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	14 Jul 202623:33	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of spring-security-core-6.5.9.jar, IBM Sterling Connect:Direct Web Services is vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition	6 Jun 202613:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for May 2026	12 Jun 202622:52	–	ibm
Chainguard	CVE-2026-22751 vulnerabilities	26 Apr 202619:17	–	cgr
Circl	CVE-2026-22751	22 Apr 202612:45	–	circl
CNNVD	Spring Security 安全漏洞	21 Apr 202600:00	–	cnnvd
CVE	CVE-2026-22751	21 Apr 202618:30	–	cve

Source	Link
spring	www.spring.io/security/cve-2026-22751
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22751.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-22751

15 Jul 2026 01:49Current

6Medium risk

Vulners AI Score6

CVSS 3.14.8

EPSS0.00124