Configuration in Spring Security - CVE-2026-22748
Published: April 27, 2026
Vulnerability identifier: #VU128225
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-22748
CWE-ID: CWE-16
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify application integrity checks.
The vulnerability exists due to improper security configuration in NimbusJwtDecoder#withIssuerLocation and NimbusReactiveJwtDecoder#withIssuerLocation when configuring JWT decoding without a separate OAuth2TokenValidator<Jwt>. A remote user can present a JWT with an unexpected issuer to modify application integrity checks.
The issue arises because issuer validation may be assumed to be enabled automatically when using withIssuerLocation.
Affected software
Spring Security
Library Support for Spring
Library Support for Spring
How to mitigate CVE-2026-22748
Install security update from vendor's website.
Spring Security - addressed in versions 6.3.15, 6.4.16, 6.5.10, 7.0.5
Library Support for Spring - update to 3.4.18
Library Support for Spring - update to 3.4.18