CVE-2026-22751

Overview

Vulnerability in Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition.
‍

Details

Module Info

• Product: Spring
• Affected packages: spring-security-core
• Affected versions: 6.4.x; 6.5.x; 7.0.x
• GitHub repository: https://github.com/spring-projects/spring-security
• Published packages: https://central.sonatype.com/artifact/org.springframework.security/spring-security-core
• Package manager: Maven
• Fixed In: NES for Spring
• Fix date: 2026-04-21
• Severity: Medium
• Category: Authorization Bypass

‍

Vulnerability Info

Vulnerability in Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition.

‍

Mitigation

Only recent versions of Spring Framework receive community support and updates. Older versions have no publicly available fixes for this vulnerability.Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Framework.
• Leverage a commercial support partner like HeroDevs for post-EOL security support through Never-Ending Support (NES) for Spring Framework.
• Review and modify the configuration of JdbcOneTimeTokenService to ensure it does not rely on One-Time Token login, if feasible.
• Implement additional logging and monitoring around token generation and validation processes to detect any anomalies or potential exploitation attempts.
• Enforce strict access controls to the database used by JdbcOneTimeTokenService, limiting access to only necessary services and users.

‍

Steps To Reproduce

1. Set up the affected environment: Deploy an application using a vulnerable Spring Security version. Ensure that the application is configured to use _JdbcOneTimeTokenService for One-Time Token login.
‍
2. Configure the One-Time Token login: In your application, explicitly configure the One-Time Token login mechanism using _JdbcOneTimeTokenService_. Ensure that the database is properly set up to store the tokens.
‍
3. Trigger the vulnerability: Simulate a race condition by initiating two simultaneous login requests using the same One-Time Token. This can be done by sending two requests to the login endpoint with the same token from different clients or threads.
‍
4. Observe the application behavior: Monitor the application's response to the simultaneous login attempts. If the application allows both requests to succeed, it confirms the presence of the TOCTOU race condition vulnerability.
‍
5. Remediate the vulnerability: Update the Spring Security library to a fixed version
‍
6. Verify the remediation: After the update, repeat the simultaneous login attempts with the same One-Time Token. Confirm that the application now rejects one of the requests, ensuring that the vulnerability has been effectively mitigated.

‍