Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2026-22748

Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

VectorNETWORK

PublishedApr 22, 2026, 06:16

Published Bysecurity@vmware.com

Base Score

Score6.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.springframework.security:spring-security-oauth2-jose(Maven)6.3.0N/AN/A

org.springframework.security:spring-security-oauth2-jose(Maven)6.4.0N/AN/A

org.springframework.security:spring-security-oauth2-jose(Maven)6.5.06.5.10N/A

org.springframework.security:spring-security-oauth2-jose(Maven)7.0.07.0.5N/A

References

https://spring.io/security/cve-2026-22748

Weakness Type

CWE-20

CVSS Metrics

Base Score

6.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK