Medium severity4.8NVD Advisory· Published Apr 21, 2026· Updated May 1, 2026
CVE-2026-22751
CVE-2026-22751
Description
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.springframework.security:spring-security-coreMaven | >= 6.5.0, < 6.5.10 | 6.5.10 |
org.springframework.security:spring-security-coreMaven | >= 7.0.3, < 7.0.5 | 7.0.5 |
org.springframework.security:spring-security-coreMaven | >= 6.4.0, <= 6.4.13 | — |
Affected products
26- osv-coords25 versionspkg:apk/chainguard/apache-nifipkg:apk/chainguard/apache-nifi-registrypkg:apk/chainguard/apache-nifi-registry-toolkitpkg:apk/chainguard/camunda-8.8pkg:apk/chainguard/camunda-8.9pkg:apk/chainguard/camunda-zeebe-8.7pkg:apk/chainguard/camunda-zeebe-8.8pkg:apk/chainguard/camunda-zeebe-8.9pkg:apk/chainguard/jenkins-2.541pkg:apk/chainguard/jenkins-2.541-openjdk-17pkg:apk/chainguard/jenkins-2.541-openjdk-21pkg:apk/chainguard/jenkins-2-openjdk-21pkg:apk/chainguard/jenkins-2-openjdk-25pkg:apk/chainguard/kafbat-uipkg:apk/chainguard/kafbat-ui-fipspkg:apk/chainguard/nacospkg:apk/chainguard/nacos-dockerpkg:apk/chainguard/thingsboard-tb-nodepkg:apk/wolfi/apache-nifipkg:apk/wolfi/apache-nifi-registrypkg:apk/wolfi/apache-nifi-registry-toolkitpkg:apk/wolfi/jenkins-2-openjdk-21pkg:apk/wolfi/jenkins-2-openjdk-25pkg:apk/wolfi/thingsboard-tb-nodepkg:maven/org.springframework.security/spring-security-core
< 2.9.0-r3+ 24 more
- (no CPE)range: < 2.9.0-r3
- (no CPE)range: < 2.9.0-r4
- (no CPE)range: < 2.9.0-r4
- (no CPE)range: < 8.8.24-r0
- (no CPE)range: < 8.9.2-r0
- (no CPE)range: < 8.7.29-r0
- (no CPE)range: < 8.8.24-r0
- (no CPE)range: < 8.9.5-r0
- (no CPE)range: < 2.541.3-r3
- (no CPE)range: < 2.541.3-r3
- (no CPE)range: < 2.541.3-r3
- (no CPE)range: < 2.555.1-r1
- (no CPE)range: < 2.555.1-r1
- (no CPE)range: < 1.4.2-r9
- (no CPE)range: < 1.4.2-r8
- (no CPE)range: < 3.2.1-r2
- (no CPE)range: < 3.2.1-r1
- (no CPE)range: < 4.3.1.1-r11
- (no CPE)range: < 2.9.0-r3
- (no CPE)range: < 2.9.0-r4
- (no CPE)range: < 2.9.0-r4
- (no CPE)range: < 2.555.1-r1
- (no CPE)range: < 2.555.1-r1
- (no CPE)range: < 4.3.1.1-r11
- (no CPE)range: >= 6.5.0, < 6.5.10
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-x2wq-9x2f-fhj7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-22751ghsaADVISORY
- spring.io/security/cve-2026-22751nvdVendor AdvisoryWEB
- github.com/spring-projects/spring-security/commit/163772775036c4146815a5266874278c6f45f047ghsaWEB
- github.com/spring-projects/spring-security/commit/4187af38b251fc97fdf9949f7869618111e6e261ghsaWEB
News mentions
0No linked articles in our index yet.