Vulnerabilities in pkg:maven/org.springframework.security/spring-security-core

PACKAGE
Advisory Identifier: GHSA-x2wq-9x2f-fhj7
Share
Advisory Summary

CVE-2026-22751 is a MODERATE (CVSS 4.8) spring security core has a vulnerability (CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition) affecting Spring Framework libraries in the Maven ecosystem. The issue involves spring security core has a toctou race condition when one-time token login with jdbconetimetokenservice is configured. Remediation is available by upgrading affected packages to version 6.5.10, 7.0.5.

31 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:maven/org.springframework.security/spring-security-core

31 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:maven/org.springframework.security/spring-security-core. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-x2wq-9x2f-fhj7 CVE-2026-22751 MODERATE Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured
GHSA-vxf7-qj7q-83fh CVE-2026-22746 LOW Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider
GHSA-vqxh-445g-37fc CVE-2025-22234 MODERATE Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide
GHSA-9pp5-9c7g-4r83 CVE-2025-41232 CRITICAL Spring Security authorization bypass for method security annotations on private methods
GHSA-8v5q-rhf3-jphm CVE-2025-41248 HIGH Spring Security annotation detection mechanism has authorization bypass
GHSA-hh3m-g4qj-4835 CVE-2025-22223 MODERATE Spring Security Vulnerable to Authorization Bypass via Security Annotations
GHSA-hmqf-wpq9-jq83 CVE-2024-38810 MODERATE Spring Security Missing Authorization vulnerability
GHSA-w3w6-26f2-p474 CVE-2024-22234 HIGH Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated
GHSA-f3jh-qvm4-mg39 CVE-2024-22257 HIGH Erroneous authentication pass in Spring Security
GHSA-q3v6-hm2v-pw99 CVE-2024-38827 MODERATE Spring Framework has Authorization Bypass for Case Sensitive Comparisons
GHSA-hh32-7344-cg2f CVE-2022-22978 CRITICAL Authorization bypass in Spring Security
GHSA-wx54-3278-m5g4 CVE-2022-22976 MODERATE Integer overflow in BCrypt class in Spring Security
GHSA-v35c-49j6-q8hq CVE-2016-9879 HIGH Security Constraint Bypass in Spring Security
GHSA-wmv4-5w76-vp9g CVE-2014-3527 CRITICAL Authorization Bypass in Spring Security
GHSA-v596-fwhq-8x48 CVE-2018-1199 MODERATE Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core
GHSA-f866-m9mv-2xr3 CVE-2011-2894 MODERATE Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data
GHSA-27xw-p8v6-9jjr CVE-2018-15801 HIGH Spring Security vulnerable to Authorization Bypass
GHSA-vhrg-v3cv-p247 CVE-2017-4995 HIGH Deserialization of Untrusted Data in Spring Security
GHSA-8crv-49fr-2h6j CVE-2016-5007 HIGH Spring Security and Spring Framework may not recognize certain paths that should be protected
GHSA-x873-6rgc-94jc CVE-2023-20862 MODERATE Spring Security logout not clearing security context
GHSA-v2r2-7qm7-jj6v CVE-2019-3795 MODERATE Spring Security uses insufficiently random values
GHSA-mmmh-wcxm-2wr4 CVE-2022-31692 CRITICAL Spring Security authorization rules can be bypassed via forward or include dispatcher types
GHSA-5xm9-rf63-wj7h CVE-2011-2732 MODERATE Improper Control of Generation of Code in Spring Security
GHSA-4644-hg35-55m9 CVE-2011-2731 MODERATE Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security
GHSA-3533-rvpc-6x56 CVE-2012-5055 MODERATE Exposure of Sensitive Information to an Unauthorized Actor in Spring Security
GHSA-3295-h9qx-r82x CVE-2010-3700 MODERATE Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security
GHSA-gv9v-c375-hvmg CVE-2014-0097 HIGH Improper Authentication in Spring Security
GHSA-w9jg-gvgr-354m CVE-2021-22119 HIGH Resource Exhaustion in Spring Security
GHSA-48rw-j489-928m CVE-2020-5407 HIGH Signature wrapping vulnerability in Spring Security
GHSA-2ppp-9496-p23q CVE-2020-5408 MODERATE Insufficient Entropy in Spring Security
GHSA-v33x-prhc-gph5 CVE-2019-11272 HIGH Insufficiently Protected Credentials and Improper Authentication in Spring Security

CVE-2026-22751 at a Glance

CVE Identifier CVE-2026-22751
GHSA Identifier GHSA-x2wq-9x2f-fhj7
Severity MODERATE
CVSS v3.1 Base Score 4.8
CWE Classification CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Affected Product Spring Framework
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 4.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity Low (I:L)
Availability None (A:N)

How to Fix CVE-2026-22751

To remediate this vulnerability, upgrade all affected Spring Framework dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.springframework.security:spring-security-core fixed: 6.5.10 
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-core</artifactId>
    <version>6.5.10</version>
</dependency>
org.springframework.security:spring-security-core fixed: 7.0.5 
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-core</artifactId>
    <version>7.0.5</version>
</dependency>
org.springframework.security:spring-security-core fixed: Latest secure release 
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-core</artifactId>
    <version>Latest secure release</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=org.springframework.security

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-22751, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.springframework.security

Analyze the terminal output to locate any version of Spring Framework in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 6.5.10), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.springframework.security command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition, where the product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. In Spring Framework, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

CVE-2026-22751 Affected Spring Framework Versions

3 component(s)
Fixed Versions:
6.5.107.0.5
Product / Package Ecosystem Affected Versions Fixed Version
org.springframework.security:spring-security-core
maven/org.springframework.security/spring-security-core
Maven
≥ 6.5.0
< 6.5.10
6.5.10
org.springframework.security:spring-security-core
maven/org.springframework.security/spring-security-core
Maven
≥ 7.0.3
< 7.0.5
7.0.5
org.springframework.security:spring-security-core
maven/org.springframework.security/spring-security-core
Maven
≥ 6.4.0
≤ 6.4.13

References

NVD — CVE-2026-22751 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22751
Security Fix Commit FIX COMMIT
https://github.com/spring-projects/spring-security/commit/163772775036c4146815a5266874278c6f45f047
Security Fix Commit FIX COMMIT
https://github.com/spring-projects/spring-security/commit/4187af38b251fc97fdf9949f7869618111e6e261
Spring Framework Source Repository REPOSITORY
https://github.com/spring-projects/spring-security
jinyeong.seol.pro/blogs/cve-2026-2275... WEB
https://jinyeong.seol.pro/blogs/cve-2026-22751/en
Spring Framework Security Information SECURITY
https://spring.io/security/cve-2026-22751

Frequently Asked Questions

What is CVE-2026-22751?
CVE-2026-22751 is a security vulnerability in Spring Framework involving Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition.
Which Spring Framework versions are affected?
Affected versions include releases prior to 6.5.10, 7.0.5 across affected packages: org.springframework.security:spring-security-core.
What version fixes CVE-2026-22751?
Upgrading to 6.5.10, 7.0.5 (or the latest patched release for your respective branch) resolves the vulnerability.
Is spring-security-core affected?
Yes, org.springframework.security:spring-security-core is affected in releases prior to 6.5.10, 7.0.5, Latest secure release. Upgrade your dependency to 6.5.10, 7.0.5, Latest secure release or later.
What is the CVSS score of CVE-2026-22751?
CVE-2026-22751 has a CVSS v3.1 base score of 4.8 (MODERATE) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.
What CWE is associated with CVE-2026-22751?
CVE-2026-22751 is classified under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition (The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.).
How can I check Maven dependencies for CVE-2026-22751?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.springframework.security'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x2wq-9x2f-fhj7",
  "modified" : "2026-07-17T20:48:57Z",
  "published" : "2026-04-21T21:31:23Z",
  "aliases" : [ "CVE-2026-22751" ],
  "summary" : "Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured",
  "details" : "Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.springframework.security:spring-security-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.5.0"
      }, {
        "fixed" : "6.5.10"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.springframework.security:spring-security-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "7.0.3"
      }, {
        "fixed" : "7.0.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.springframework.security:spring-security-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.4.0"
      }, {
        "last_affected" : "6.4.13"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-22751"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/spring-projects/spring-security/commit/163772775036c4146815a5266874278c6f45f047"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/spring-projects/spring-security/commit/4187af38b251fc97fdf9949f7869618111e6e261"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/spring-projects/spring-security"
  }, {
    "type" : "WEB",
    "url" : "https://jinyeong.seol.pro/blogs/cve-2026-22751/en"
  }, {
    "type" : "WEB",
    "url" : "https://spring.io/security/cve-2026-22751"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-367" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-25T23:38:48Z",
    "nvd_published_at" : "2026-04-21T19:16:16Z"
  }
}