CVE-2026-22752
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
An authentication bypass vulnerability due to a primary weakness in Spring Authorization Server. Affects versions from 7.0.0 to 7.0.4, from 1.5.0 to 1.5.6, from 1.4.0 to 1.4.9, and from 1.3.0 to 1.3.10.
Risk Assessment
An attacker can bypass authentication mechanisms, leading to unauthorized access to protected resources and potential account takeover.
Recommendation
Immediately update Spring Authorization Server to the latest available version that includes a fix for this vulnerability.
Other vulnerabilities in Spring Authorization Server
See all- CVE-2026-59316High
Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. An attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page. Affected versions are 1.5.0-1.5.8 and 1.4.0-1.4.11.
- CVE-2026-59355Medium
In Spring Authorization Server versions 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request with an invalid request_uri and an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.
Original NVD description (English source)
Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.