ROOT-APP-MAVEN-AIKIDO-2026-61483 AIKIDO-2026-61483 in org.springframework.security:spring-security-oauth2-jose - Patched by Root

Root has patched AIKIDO-2026-61483 in the org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available...

be.appify.prefab:prefab-security (>=0.2.0, <=0.10.9), br.com.sawcunhaos:scos-foundation-security (1.1.0) +606 more potentially affected by CVE-2026-41707 via org.springframework.security:spring-security-oauth2-jose (>=7.0.0, <=7.0.6)

org.springframework.security:spring-security-oauth2-jose MAVEN version =7.0.0, =0.2.0, =5.0.0, =5.0.0, =5.0.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =4.0.0-alpha-springboot4,...

be.appify.prefab:prefab-security (>=0.11.0, <=0.12.0), build.jenesis:build.jenesis.repository.bundle (>=0.1.0, <=0.7.0) +428 more potentially affected by CVE-2026-41707 via org.springframework.security:spring-security-oauth2-jose (7.1.0)

org.springframework.security:spring-security-oauth2-jose MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-jose and may be impacted: - be.appify.prefab:prefab-security =0.11.0, =0.1....

Replay Attack

Overview org.springframework.security:spring-security-oauth2-jose is a provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Replay Attack through the DPoPProofJwtDecoderFactory. An attacker can gain unauthorized access and impersonate a victim...

ai.mindconnect:mc-agent-admin-ui-app (>=0.0.2, <=0.8.4), ai.mindconnect:mc-agent-admin-ui-rest (>=0.0.2, <=0.8.4) +1192 more potentially affected by CVE-2026-41707 via org.springframework.security:spring-security-oauth2-jose (>=6.5.0, <=7.0.6)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.5.0, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =1.0.0.ee-20260424025040, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =1.24.0, =1.24.0, =6.3.0 and more Source cves: CVE-2026-41707 Source advisory:...

be.appify.prefab:prefab-security (>=0.11.0, <=0.12.0), build.jenesis:build.jenesis.repository.bundle (>=0.1.0, <=0.7.0) +428 more potentially affected by CVE-2026-41707 via org.springframework.security:spring-security-oauth2-jose (7.1.0)

org.springframework.security:spring-security-oauth2-jose MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-jose and may be impacted: - be.appify.prefab:prefab-security =0.11.0, =0.1....

ROOT-APP-MAVEN-CVE-2026-22748 CVE-2026-22748 in io.root.org.springframework.security:spring-security-oauth2-jose - Patched by Root

Root has patched CVE-2026-22748 in the io.root.org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available...

ai.mindconnect:mc-agent-admin-ui-app (>=0.0.2, <=0.8.4), ai.mindconnect:mc-agent-admin-ui-rest (>=0.0.2, <=0.8.4) +1339 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.0.0, <=6.5.9)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.0.0, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =0.5.2, =0.5.0, =7.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.10.0, =4.27.0 and more Source cves: CVE-2026-22748 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +325 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-oauth2-jose MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4...

ai.mindconnect:mc-agent-admin-ui-app (>=0.0.2, <=0.8.4), ai.mindconnect:mc-agent-admin-ui-rest (>=0.0.2, <=0.8.4) +767 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.5.0, <=6.5.9)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.5.0, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =0.1.0, =0.1.0, =0.1.0, =1.24.0, =1.24.0, =1.24.0, =1.0.0, =1.0.0, =2.2.0 and more Source cves: CVE-2026-22748 Source advisory: GHSA-CVC6-Q2CP-2XHW...

ch.admin.bit.jeap:jeap-archrepo-instance (>=1.10.0, <=1.23.0), ch.admin.bit.jeap:jeap-archrepo-test (>=1.10.0, <=1.23.0) +482 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.4.0, <=6.4.13)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.4.0, =1.10.0, =1.10.0, =1.10.0, =1.55.1, =1.55.1, =3.1.0, =3.1.0, =8.4.0, =1.0.0, =17.16.0, =17.16.0, =17.16.0, =17.16.0, =17.16.0, =17.16.0, =17.38.0 and more Source cves: CVE-2026-22748 Source advisory: GHS...

au.csiro.pathling:fhir-server (7.2.0), best.skn:skn-spring-security (>=1.3.0, <=1.5.0) +476 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.3.0, <=6.3.10)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.3.0, =1.3.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.1 and more Source cves: CVE-2026-22748 Source advisory:...

ch.admin.bit.jeap:jeap-archrepo-instance (>=1.10.0, <=1.23.0), ch.admin.bit.jeap:jeap-archrepo-test (>=1.10.0, <=1.23.0) +482 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.4.0, <=6.4.13)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.4.0, =1.10.0, =1.10.0, =1.10.0, =1.55.1, =1.55.1, =3.1.0, =3.1.0, =8.4.0, =1.0.0, =17.16.0, =17.16.0, =17.16.0, =17.16.0, =17.16.0, =17.16.0, =17.38.0 and more Source cves: CVE-2026-22748 Source advisory: OSV...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +325 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-oauth2-jose MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4...

ai.mindconnect:mc-agent-admin-ui-app (>=0.0.2, <=0.8.4), ai.mindconnect:mc-agent-admin-ui-rest (>=0.0.2, <=0.8.4) +767 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.5.0, <=6.5.9)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.5.0, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =0.1.0, =0.1.0, =0.1.0, =1.24.0, =1.24.0, =1.24.0, =1.0.0, =1.0.0, =2.2.0 and more Source cves: CVE-2026-22748 Source advisory: OSV:GHSA-CVC6-Q2CP-2XHW...

au.csiro.pathling:fhir-server (7.2.0), best.skn:skn-spring-security (>=1.3.0, <=1.5.0) +476 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.3.0, <=6.3.10)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.3.0, =1.3.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.1 and more Source cves: CVE-2026-22748 Source advisory: GHSA-CVC6-Q2CP-2X...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +325 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-oauth2-jose MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4...

ai.mindconnect:mc-agent-admin-ui-app (>=0.0.2, <=0.8.4), ai.mindconnect:mc-agent-admin-ui-rest (>=0.0.2, <=0.8.4) +767 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.5.0, <=6.5.9)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.5.0, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =0.1.0, =0.1.0, =0.1.0, =1.24.0, =1.24.0, =1.24.0, =1.0.0, =1.0.0, =2.2.0 and more Source cves: CVE-2026-22748 Source advisory: MEND:CVE-2026-22748...

ch.admin.bit.jeap:jeap-archrepo-instance (>=1.10.0, <=1.23.0), ch.admin.bit.jeap:jeap-archrepo-test (>=1.10.0, <=1.23.0) +482 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.4.0, <=6.4.13)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.4.0, =1.10.0, =1.10.0, =1.10.0, =1.55.1, =1.55.1, =3.1.0, =3.1.0, =8.4.0, =1.0.0, =17.16.0, =17.16.0, =17.16.0, =17.16.0, =17.16.0, =17.16.0, =17.38.0 and more Source cves: CVE-2026-22748 Source advisory: MEN...

au.csiro.pathling:fhir-server (7.2.0), best.skn:skn-spring-security (>=1.3.0, <=1.5.0) +476 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.3.0, <=6.3.10)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.3.0, =1.3.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.1 and more Source cves: CVE-2026-22748 Source advisory: MEND:CVE-2026-227...