org.springframework.security/spring-security-oauth2-jose vulnerabilities

Latest org.springframework.security/spring-security-oauth2-jose CVEs

Newest publication first

1. CVE-2026-22748 Potential Security Misconfiguration when Using withIssuerLocation

   Published 2026-04-22

   Medium·CVSS 6.5 EPSS 0.20%

   Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0...

2. CVE-2018-15801 Authorization Bypass During JWT Issuer Validation with spring-security

   Published 2018-12-19

   High·CVSS 7.4 EPSS 0.65%

   Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could f...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.