CVE-2026-22748: Spring Security Auth Bypass Vulnerability

CVE-2026-22748 Overview

A vulnerability exists in Spring Security affecting JWT token validation when applications configure JWT decoding using NimbusJwtDecoder or NimbusReactiveJwtDecoder. When these decoders are used, applications must separately configure an OAuth2TokenValidator<Jwt> by calling setJwtValidator. Failure to properly configure validation can lead to improper input validation of JWT tokens, potentially allowing attackers to bypass security controls.

Critical Impact

Applications using Spring Security's Nimbus JWT decoders without proper validator configuration may accept invalid or malicious JWT tokens, potentially leading to unauthorized access or integrity bypass.

Affected Products

• Spring Security versions 6.3.0 through 6.3.14
• Spring Security versions 6.4.0 through 6.4.14
• Spring Security versions 6.5.0 through 6.5.9
• Spring Security versions 7.0.0 through 7.0.4

Discovery Timeline

• 2026-04-22 - CVE CVE-2026-22748 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-22748

Vulnerability Analysis

This vulnerability is classified under CWE-20 (Improper Input Validation) and affects Spring Security's JWT authentication mechanisms. The issue arises from a configuration gap where applications using NimbusJwtDecoder or NimbusReactiveJwtDecoder must explicitly configure JWT validation through the setJwtValidator method. Without this additional configuration step, the JWT decoding process may not perform adequate validation checks on incoming tokens.

The network-based attack vector with high complexity requirements indicates that exploitation requires specific conditions to be met, including the target application having the vulnerable configuration pattern. The integrity impact is high, meaning successful exploitation could allow attackers to modify or forge authentication tokens.

Root Cause

The root cause stems from a design pattern in Spring Security's Nimbus JWT decoder implementation where token validation is decoupled from token decoding. While NimbusJwtDecoder and NimbusReactiveJwtDecoder handle the parsing and decoding of JWT tokens, the validation logic must be explicitly attached via OAuth2TokenValidator<Jwt>. Applications that configure JWT decoding without also configuring appropriate validators leave a security gap where tokens may not be properly validated for claims, expiration, issuer, or other critical fields.

Attack Vector

The vulnerability is exploitable over the network and requires low privileges but high attack complexity. An attacker would need to:

1. Identify a target application using Spring Security with NimbusJwtDecoder or NimbusReactiveJwtDecoder
2. Determine that the application has not properly configured OAuth2TokenValidator<Jwt>
3. Craft malicious JWT tokens that would normally fail validation checks
4. Submit these tokens to bypass authentication or authorization controls

The attack targets the integrity of the authentication process, potentially allowing unauthorized actions without impacting confidentiality or availability directly.

Detection Methods for CVE-2026-22748

Indicators of Compromise

• Unusual JWT token patterns in application logs that bypass standard validation rules
• Authentication events with tokens containing unexpected or missing claims
• Increased authentication activity from unknown or suspicious sources
• Application audit logs showing successful authentication with malformed tokens

Detection Strategies

• Review Spring Security configurations for NimbusJwtDecoder and NimbusReactiveJwtDecoder usage without corresponding setJwtValidator calls
• Implement application-level logging for JWT token validation failures and successes
• Monitor for JWT tokens with anomalous claim values or missing required fields
• Deploy static code analysis tools to identify vulnerable configuration patterns

Monitoring Recommendations

• Enable detailed authentication logging in Spring Security applications
• Monitor API endpoints accepting JWT authentication for unusual access patterns
• Implement alerting on authentication attempts with tokens that would fail strict validation
• Review application dependencies to identify affected Spring Security versions

How to Mitigate CVE-2026-22748

Immediate Actions Required

• Audit all applications using NimbusJwtDecoder or NimbusReactiveJwtDecoder for proper validator configuration
• Ensure setJwtValidator is called with appropriate OAuth2TokenValidator<Jwt> implementations
• Update Spring Security to patched versions when available
• Review authentication logs for signs of exploitation attempts

Patch Information

Spring has issued a security advisory for this vulnerability. Organizations should consult the Spring Security Advisory CVE-2026-22748 for detailed patching guidance and updated version information. Upgrade paths include moving to versions beyond the affected ranges:

• Upgrade from 6.3.x to version 6.3.15 or later
• Upgrade from 6.4.x to version 6.4.15 or later
• Upgrade from 6.5.x to version 6.5.10 or later
• Upgrade from 7.0.x to version 7.0.5 or later

Workarounds

• Explicitly configure OAuth2TokenValidator<Jwt> on all NimbusJwtDecoder and NimbusReactiveJwtDecoder instances
• Implement custom validators that verify issuer, audience, expiration, and other critical JWT claims
• Consider using alternative JWT decoder configurations that include built-in validation
• Add additional application-layer validation of JWT claims before processing requests

# Configuration example - Review Spring Security bean configuration
# Ensure JwtDecoder beans include validator configuration:
# 
# @Bean
# public JwtDecoder jwtDecoder() {
#     NimbusJwtDecoder decoder = NimbusJwtDecoder.withJwkSetUri(jwkSetUri).build();
#     decoder.setJwtValidator(new DelegatingOAuth2TokenValidator<>(
#         JwtValidators.createDefaultWithIssuer(issuerUri)
#     ));
#     return decoder;
# }
#
# Verify Spring Security version in pom.xml or build.gradle
grep -r "spring-security" pom.xml build.gradle 2>/dev/null