Improper Authentication

🗓️ 30 Apr 2026 07:25:22Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 2 Views

Improper authentication in Spring Security OAuth due to missing JSON Web Token validator config, enabling crafted token bypass.

Reporter	Title	Published	Views	Family All 30
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	24 May 202615:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	28 May 202613:24	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	9 May 202608:59	–	ibm
ATTACKERKB	CVE-2026-22748	22 Apr 202605:15	–	attackerkb
Chainguard	CVE-2026-22748 vulnerabilities	30 Apr 202619:17	–	cgr
Circl	CVE-2026-22748	22 Apr 202608:26	–	circl
CNNVD	Spring Security 输入验证错误漏洞	22 Apr 202600:00	–	cnnvd
CVE	CVE-2026-22748	22 Apr 202605:15	–	cve
Cvelist	CVE-2026-22748 Potential Security Misconfiguration when Using withIssuerLocation	22 Apr 202605:15	–	cvelist
EUVD	EUVD-2026-24610	22 Apr 202606:30	–	euvd

Vulners

Node

springframework spring-security-oauth2-joseRange7.0.0-M1–7.0.4java

springframework spring-security-oauth2-joseRange6.5.0-M1–6.5.9java

springframework spring-security-oauth2-joseRange6.4.0-M1–6.4.14java

springframework spring-security-oauth2-joseRange6.3.0-M1–6.3.14java

springframework spring-security-oauth2-joseMatch6.3.0java

springframework spring-security-oauth2-joseMatch6.3.1java

springframework spring-security-oauth2-joseMatch6.3.10java

springframework spring-security-oauth2-joseMatch6.3.2java

springframework spring-security-oauth2-joseMatch6.3.3java

springframework spring-security-oauth2-joseMatch6.3.4java

springframework spring-security-oauth2-joseMatch6.3.5java

springframework spring-security-oauth2-joseMatch6.3.6java

springframework spring-security-oauth2-joseMatch6.3.7java

springframework spring-security-oauth2-joseMatch6.3.8java

springframework spring-security-oauth2-joseMatch6.3.9java

springframework spring-security-oauth2-joseMatch6.4.0java

springframework spring-security-oauth2-joseMatch6.4.1java

springframework spring-security-oauth2-joseMatch6.4.10java

springframework spring-security-oauth2-joseMatch6.4.11java

springframework spring-security-oauth2-joseMatch6.4.12java

springframework spring-security-oauth2-joseMatch6.4.13java

springframework spring-security-oauth2-joseMatch6.4.2java

springframework spring-security-oauth2-joseMatch6.4.3java

springframework spring-security-oauth2-joseMatch6.4.4java

springframework spring-security-oauth2-joseMatch6.4.5java

springframework spring-security-oauth2-joseMatch6.4.6java

springframework spring-security-oauth2-joseMatch6.4.7java

springframework spring-security-oauth2-joseMatch6.4.8java

springframework spring-security-oauth2-joseMatch6.4.9java

springframework spring-security-oauth2-joseMatch6.5.0java

springframework spring-security-oauth2-joseMatch6.5.1java

springframework spring-security-oauth2-joseMatch6.5.2java

springframework spring-security-oauth2-joseMatch6.5.3java

springframework spring-security-oauth2-joseMatch6.5.4java

springframework spring-security-oauth2-joseMatch6.5.5java

springframework spring-security-oauth2-joseMatch6.5.6java

springframework spring-security-oauth2-joseMatch6.5.7java

springframework spring-security-oauth2-joseMatch6.5.8java

springframework spring-security-oauth2-joseMatch7.0.0java

springframework spring-security-oauth2-joseMatch7.0.1java

springframework spring-security-oauth2-joseMatch7.0.2java

springframework spring-security-oauth2-joseMatch7.0.3java

springframework spring-security-oauth2-joseRange6.3.0–6.3.14java

springframework spring-security-oauth2-joseRange6.4.0–6.4.14java

springframework spring-security-oauth2-joseRange6.5.0–6.5.9java

springframework spring-security-oauth2-joseRange7.0.0–7.0.4java

Source	Link
github	www.github.com/spring-projects/spring-security/commit/835d6c1fbd54eab6737e0c60cece104ec7e4b724
github	www.github.com/advisories/GHSA-cvc6-q2cp-2xhw

23 May 2026 05:46Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.15.3 - 6.5

EPSS0.00075

SSVC