CVE-2026-22748: Potential Security Misconfiguration when Using withIssuerLocation
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22748?
CVE-2026-22748 has been classified as a moderate severity vulnerability due to potential security misconfigurations.
How do I fix CVE-2026-22748?
To fix CVE-2026-22748, ensure that your application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder using a valid OAuth2TokenValidator<Jwt> by calling setJwtValidator.
Which versions of Spring Security are affected by CVE-2026-22748?
CVE-2026-22748 affects Spring Security versions ranging from 6.3.0 to 6.3.14, 6.4.0 to 6.4.14, 6.5.0 to 6.5.9, and 7.0.0 to 7.0.4.
What can happen if CVE-2026-22748 is exploited?
If CVE-2026-22748 is exploited, it may lead to security misconfigurations that could affect the integrity and confidentiality of JWT tokens.
Is there a patch available for CVE-2026-22748?
Yes, a patch addressing CVE-2026-22748 is available in the latest releases of affected Spring Security versions.