CVE-2026-22748: VMware Spring Security

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

Affected products

• VMware Spring Security: before 6.3.15 (fixed in 6.3.15); from 6.4.0, before 6.4.15 (fixed in 6.4.15); from 6.5.0, before 6.5.10 (fixed in 6.5.10); from 7.0.0, before 7.0.5 (fixed in 7.0.5)

Published 2026-04-22. Last modified 2026-06-17.