CVE-2026-22748

MEDIUM · 5.3 CVSS Gepubliceerd: 22-04-2026 CWE-20

Beschrijving

Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

Vendors

Vmware

Affected products

Spring Security

References

spring.io