ROOT-APP-MAVEN-AIKIDO-2026-61483 AIKIDO-2026-61483 in org.springframework.security:spring-security-oauth2-jose - Patched by Root

Root has patched AIKIDO-2026-61483 in the org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available...

Replay Attack

Overview org.springframework.security:spring-security-oauth2-jose is a provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Replay Attack through the DPoPProofJwtDecoderFactory. An attacker can gain unauthorized access and impersonate a victim...

ROOT-APP-MAVEN-CVE-2026-22748 CVE-2026-22748 in io.root.org.springframework.security:spring-security-oauth2-jose - Patched by Root

Root has patched CVE-2026-22748 in the io.root.org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available...

CVE-2026-54430

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2josejwksawsalbresolve function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to albbaseurl without URL encoding or path sanitization, and the HTT...

CVE-2026-54430

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2josejwksawsalbresolve function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to albbaseurl without URL encoding or path sanitization, and the HTT...

Information Leakage

spring-security-oauth2-jose is vulnerable to information leakage. It reveals class information via the exception message when a plain unsigned JWT signature is submitted...