CVE-2026-22748
Fixed in a distro release EPSS <1%CVSS 5.3
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Products: Spring Security
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework.security:spring-security-oauth2-jose | no fix |
| Maven | org.springframework.security:spring-security-oauth2-jose | 6.5.10 |
| Maven | org.springframework.security:spring-security-oauth2-jose | 7.0.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apache-nifi | 2.9.0-r3 |
| Chainguard | camunda-8.8 | 8.8.24-r0 |
| Chainguard | camunda-zeebe-8.6 | 8.6.40-r0 |
| Chainguard | camunda-zeebe-8.7 | 8.7.28-r1 |
| Chainguard | camunda-zeebe-8.8 | 8.8.24-r0 |
| Chainguard | camunda-zeebe-8.9 | 8.9.5-r0 |
| Chainguard | kafbat-ui | 1.4.2-r9 |
| Chainguard | kafbat-ui-fips | 1.4.2-r8 |
| Chainguard | thingsboard-tb-node | 4.3.1.1-r6 |
| Wolfi | apache-nifi | 2.9.0-r3 |
| Wolfi | thingsboard-tb-node | 4.3.1.1-r6 |