Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2026-22751

Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring Security

Default version status: unaffected

  • 6.4.0 to ≤ 6.4.15affected
  • 6.5.0 to ≤ 6.5.9affected
  • 7.0.0 to ≤ 7.0.4affected

References