CVE-2026-22751: spring spring security
CVSS: 4.8v3.1MediumAnalyzed
AliasesCGA-2mc5-94mq-j548CGA-3g2g-47rp-c64jCGA-57xg-57fr-6765CGA-64hw-2v8v-jcv6CGA-6xj4-pf2r-x57hCGA-76xw-xw5f-55jrCGA-83rr-95rh-g8hvCGA-9v2p-2527-72pgCGA-c42g-c636-g32vCGA-g4pf-4v47-h93jCGA-hq6m-vf97-qwhpCGA-jj89-mwvr-3xwcCGA-p7m5-gcjp-jw6cCGA-q2c6-fh3x-836xCGA-q547-3vpc-79r3CGA-r439-39cr-wc6cCGA-r457-28j9-p87mCGA-wqv6-5j39-8vp5CGA-wrf6-r6jx-9xjjCGA-x6q7-h3jg-8g9cCGA-2vv5-wf3p-q7q4CGA-335m-wv5j-6pw6CGA-3p6q-px43-94mmCGA-42hj-2g5c-h2jxCGA-4x9j-74v6-2rcwCGA-582w-qmcq-8443CGA-5p72-4qw7-xmmvCGA-5pjr-gqj4-6rhhCGA-639j-5899-7c3hCGA-6jv6-gmjf-46phCGA-74qm-fvr2-846hCGA-77xg-4h4p-36hcCGA-8rjm-76ph-rj47CGA-8w8p-r6j7-8pmpCGA-9fq4-v6qc-hpfvCGA-9rf7-qjp9-ppqqCGA-cr4w-xv64-wv5mCGA-g367-fh4w-93hxCGA-ghq5-hwgp-2wf5CGA-h9jr-jmmc-qq6xCGA-j3jc-xqmq-xc6hCGA-j5gr-6j6c-j9f8CGA-p5h9-ffpm-3w88CGA-pff3-hmqv-83x6CGA-pgc9-p6x8-wvgxCGA-prfg-w4gg-rf9pGHSA-x2wq-9x2f-fhj7CGA-rxfr-7qc7-58hhCGA-x734-p4r5-r32hCGA-xfwr-58w4-6p6rCGA-xmc4-7ggf-f8r2
Published 21-04-2026Last modified 21-04-2026
Vulnerability summary
CVE-2026-22751 is a medium (CVSS 4.8) vulnerability in spring spring security. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.9% of scored vulnerabilities.
CVSS score
4.8/10
010
Medium · v3.1 (CVE.org)EPSS score
0.12%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 21-04-2026PublishedVulnerability first disclosed.
- 21-04-2026Last modifiedVulnerability information updated.
Description
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 4.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- OSV · MavenEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- NVDNIST4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.12%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
0.00 pp
From 0.12% on 18-09-2026
18-09-202618-10-2026
EPSS score0.12%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard21 products
- apache-nifi< 2.9.0-r3 | < 2.9.0-r0
- apache-nifi-registry< 2.9.0-r4
- apache-nifi-registry-toolkit< 2.9.0-r4
- camunda-8.8< 8.8.24-r0
- camunda-8.9< 8.9.2-r0
Wolfi6 products
- apache-nifi< 2.9.0-r3 | < 2.9.0-r0
- apache-nifi-registry< 2.9.0-r4
- apache-nifi-registry-toolkit< 2.9.0-r4
- jenkins-2-openjdk-21< 2.555.1-r1
- jenkins-2-openjdk-25< 2.555.1-r1
Org.springframework.security1 product
- spring-security-core≥ 6.5.0, < 6.5.10 | ≥ 7.0.3, < 7.0.5 | ≥ 6.4.0, ≤ 6.4.13
Spring1 product
- spring security≥ 6.4.0, ≤ 6.4.15 | ≥ 6.5.0, ≤ 6.5.9 | ≥ 7.0.0, ≤ 7.0.4
Vmware1 product
- spring_security≥ 6.4.0, < 6.4.16 | ≥ 6.5.0, < 6.5.10 | ≥ 7.0.0, < 7.0.5
5 vendors · 30 products
