CVE-2026-22751: VMware Spring Security

Medium severity, CVSS 4.8. EPSS: 0.1% chance of exploitation in the next 30 days.

Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

Affected products

• VMware Spring Security: from 6.4.0, before 6.4.16 (fixed in 6.4.16); from 6.5.0, before 6.5.10 (fixed in 6.5.10); from 7.0.0, before 7.0.5 (fixed in 7.0.5)

Published 2026-04-21. Last modified 2026-06-17.