medium5.3
CVE-2026-22748
Spring Security has Potential Security Misconfiguration when Using withIssuerLocation
Impact
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.security:spring-security-oauth2-jose | >= 6.3.0, <= 6.3.14 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring Security | before 6.3.15 from 6.4.0 before 6.4.15 from 6.5.0 before 6.5.10 from 7.0.0 before 7.0.5 |