CVE-2026-22748: Potential Security Misconfiguration when Using withIssuerLocation
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Other sources
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidatorJwt separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22748?
CVE-2026-22748 has been classified as a moderate severity vulnerability due to potential security misconfigurations.
How do I fix CVE-2026-22748?
To fix CVE-2026-22748, ensure that your application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder using a valid OAuth2TokenValidator<Jwt> by calling setJwtValidator.
Which versions of Spring Security are affected by CVE-2026-22748?
CVE-2026-22748 affects Spring Security versions ranging from 6.3.0 to 6.3.14, 6.4.0 to 6.4.14, 6.5.0 to 6.5.9, and 7.0.0 to 7.0.4.
What can happen if CVE-2026-22748 is exploited?
If CVE-2026-22748 is exploited, it may lead to security misconfigurations that could affect the integrity and confidentiality of JWT tokens.
Is there a patch available for CVE-2026-22748?
Yes, a patch addressing CVE-2026-22748 is available in the latest releases of affected Spring Security versions.