Time-of-check Time-of-use (TOCTOU) Race Condition in Spring Security - CVE-2026-22751

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU128222

Time-of-check Time-of-use (TOCTOU) Race Condition in Spring Security - CVE-2026-22751

Published: April 27, 2026


Vulnerability identifier: #VU128222
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-22751
CWE-ID: CWE-367
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to establish multiple authenticated sessions with a one-time token.

The vulnerability exists due to a time-of-check time-of-use race condition in JdbcOneTimeTokenService when handling concurrent requests to the authentication endpoint. A remote attacker can send concurrent authentication requests using a valid one-time token to establish multiple authenticated sessions with a one-time token.

Only applications that explicitly configure one-time token login with JdbcOneTimeTokenService are vulnerable. The default InMemoryOneTimeTokenService is not affected.


Affected software

Spring Security
Library Support for Spring
IBM Sterling Connect:Direct Web Services
MongoDB Enterprise Advanced with IBM

How to mitigate CVE-2026-22751

Install security update from vendor's website.

Spring Security - addressed in versions 6.4.16, 6.5.10, 7.0.5
Library Support for Spring - update to 3.4.18
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.19, 6.4.0.8
MongoDB Enterprise Advanced with IBM - update to 1.16.0

External References

Related Security Bulletins