EUVD-2026-24610

Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from...

EUVD-2026-24612

Vulnerability in Spring Spring Security. If an application uses to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from...

GHSA-CVC6-Q2CP-2XHW Spring Security has Potential Security Misconfiguration when Using withIssuerLocation

Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator. This issue affects Spring Security: from 6.3.0 through 6.3.14, from...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +863 more potentially affected by CVE-2026-22754 via org.springframework.security:spring-security-config (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-config MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

Spring Security Doesn't Correctly Include Servlet Path in Path Matching of HttpSecurity#securityMatchers

Vulnerability in Spring Spring Security. If an application is using securityMatchersString and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the...

Spring Security has Potential Security Misconfiguration when Using withIssuerLocation

Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator. This issue affects Spring Security: from 6.3.0 through 6.3.14, from...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +863 more potentially affected by CVE-2026-22754 via org.springframework.security:spring-security-config (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-config MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

GHSA-4WRG-8WPC-H923 Spring Security Doesn't Correctly Include Servlet Path in Path Matching of HttpSecurity#securityMatchers

Vulnerability in Spring Spring Security. If an application is using securityMatchersString and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the...

Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +911 more potentially affected by CVE-2026-22747 via org.springframework.security:spring-security-web (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-web MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

EUVD-2026-24609

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user...

EUVD-2026-24607

Vulnerability in Spring Spring Security. If an application is using the UserDetailsisEnabled, isAccountNonExpired, or isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, o...

Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider

Vulnerability in Spring Spring Security. If an application is using the UserDetailsisEnabled, isAccountNonExpired, or isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, o...

GHSA-VXF7-QJ7Q-83FH Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider

Vulnerability in Spring Spring Security. If an application is using the UserDetailsisEnabled, isAccountNonExpired, or isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, o...

ai.mindconnect:mc-agent-admin-ui-app (>=0.0.2, <=0.8.4), ai.mindconnect:mc-agent-admin-ui-rest (>=0.0.2, <=0.8.4) +3065 more potentially affected by CVE-2026-22746 via org.springframework.security:spring-security-core (>=6.5.0, <=6.5.9)

org.springframework.security:spring-security-core MAVEN version =6.5.0, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =0.6.0, =0.1.0, =0.1.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.1.21 and more Source cves: CVE-2026-22746 Source advisory: GHSA-VXF7-QJ7Q-83FH...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +1125 more potentially affected by CVE-2026-22746 via org.springframework.security:spring-security-core (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-core MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +2664 more potentially affected by CVE-2026-22746 via org.springframework.security:spring-security-core (>=6.3.0, <=6.3.10)

org.springframework.security:spring-security-core MAVEN version =6.3.0, =cloud-0.1, =0.6 - ai.langsa:pom-ccaas-langsa 0.1 - ai.yda-framework:channel-shared 0.1.0 - ai.yda-framework:rest-spring-channel 0.1.0 - ai.yda-framework:rest-spring-streaming-channel 0.1.0 - ai.ylyue:yue-library-base j17.3.3...

app.valuationcontrol:library (>=0.5.8, <=0.5.9), at.aimon.ops:aimon-ops-api (>=0.0.1, <=0.0.2) +2768 more potentially affected by CVE-2026-22746 via org.springframework.security:spring-security-core (>=6.4.0, <=6.4.13)

org.springframework.security:spring-security-core MAVEN version =6.4.0, =0.5.8, =0.0.1, =55.v51410e712e0c, =1.5.4.release, =1.0.1, =1.0.2, =1.0.4, =1.0.2, =1.0.16, =1.0.2, =1.0.4, =1.0.18 - cc.zzzyu.nacos:nacos-ai 3.1.1 - cc.zzzyu.nacos:nacos-cmdb 3.1.1 - cc.zzzyu.nacos:nacos-config 3.1.1 and mor...

ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +2664 more potentially affected by CVE-2026-22746 via org.springframework.security:spring-security-core (>=6.3.0, <=6.3.10)

org.springframework.security:spring-security-core MAVEN version =6.3.0, =cloud-0.1, =0.6 - ai.langsa:pom-ccaas-langsa 0.1 - ai.yda-framework:channel-shared 0.1.0 - ai.yda-framework:rest-spring-channel 0.1.0 - ai.yda-framework:rest-spring-streaming-channel 0.1.0 - ai.ylyue:yue-library-base j17.3.3...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +1125 more potentially affected by CVE-2026-22746 via org.springframework.security:spring-security-core (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-core MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...