CVE-2026-22748

Overview

Vulnerability in Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.

‍

Details

Module Info

• Product: Spring
• Affected packages: spring-security-oauth2-jose
• Affected versions: 6.2.x; 6.3.x; 6.4.x; 6.5.x; 7.0.x
• GitHub repository: https://github.com/spring-projects/spring-security
• Published packages: https://central.sonatype.com/artifact/org.springframework.security/spring-security-oauth2-jose
• Package manager: Maven
• Fixed In: NES for Spring
• Fix date: 2026-04-21
• Severity: Medium
• Category: Weak Authentication

‍

Vulnerability Info

Vulnerability in Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator.

‍

Mitigation

Only recent versions of Spring Framework receive community support and updates. Older versions have no publicly available fixes for this vulnerability.

Users of the affected components should apply one of the following mitigations:

• Configure an OAuth2TokenValidator<Jwt> for JWT decoding by calling setJwtValidator on NimbusJwtDecoder or NimbusReactiveJwtDecoder to ensure proper validation of JWT tokens.
• Upgrade to a currently supported version of Spring Framework.
• Leverage a commercial support partner like HeroDevs for post-EOL security support through Never-Ending Support (NES) for Spring Framework.

‍

Steps To Reproduce

1. Set up a Spring application environment using one of the affected versions of Spring Security. Ensure that the application is configured to use NimbusJwtDecoder or NimbusReactiveJwtDecoder for JWT decoding.

2. In the application configuration, intentionally omit the configuration of an OAuth2TokenValidator<Jwt> for the NimbusJwtDecoder or NimbusReactiveJwtDecoder. This can be done by not calling setJwtValidator() in the security configuration.

3. Deploy the application and ensure it is running. Use a tool like Postman or cURL to send a request to an endpoint that requires JWT authentication, providing a valid JWT token that the application should decode.

4. Observe the application's behavior upon receiving the request. If the application does not validate the JWT properly due to the missing OAuth2TokenValidator<Jwt>, it may allow unauthorized access to protected resources or fail to reject invalid tokens.

5. To remediate the vulnerability, upgrade the Spring Security version to a fixed version depending on your current version. Ensure that the application is configured correctly by including a proper OAuth2TokenValidator<Jwt>.

6. After applying the upgrade, redeploy the application and repeat the JWT authentication request. Verify that the application now correctly validates the JWT and denies access to any unauthorized tokens, confirming that the vulnerability has been mitigated.