CVE-2018-1256: VMware Spring Cloud SSO Connector

High severity, CVSS 8.1. EPSS: 1.6% chance of exploitation in the next 30 days.

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of the SSO Connector with tokens generated from another service plan.

Affected products

• VMware Spring Cloud SSO Connector: version 2.1.2 only

Published 2018-05-07. Last modified 2026-06-17.