CVE-2022-22969

Vulnerability

Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application [1][2][3]. The vulnerability affects only OAuth 2.0 Client applications using the Authorization Code Grant flow.

Exploitation

An attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant using a single session [1][2][3]. No authentication or special privileges are required; the attacker only needs network access to the client application's authorization endpoint.

Impact

Successful exploitation can exhaust system resources (CPU, memory, or connection pools) leading to a Denial-of-Service condition [1][2][3]. The attack does not result in data disclosure or privilege escalation; it solely impacts availability.

Mitigation

Users should upgrade to Spring Security OAuth version 2.5.2 or later [2][3]. For older unsupported versions, upgrading to a supported version is recommended. No workarounds are documented. The vulnerability was disclosed on April 21, 2022 [2][3].