CVE-2026-22752: Spring Authorization Server Auth Bypass

CVE-2026-22752 Overview

CVE-2026-22752 is an authentication bypass vulnerability in the Spring Security Spring Authorization Server. The flaw affects multiple release branches, including versions 7.0.0 through 7.0.4, 1.5.0 through 1.5.6, 1.4.0 through 1.4.9, and 1.3.0 through 1.3.10. An attacker with low-privileged network access can bypass authentication controls, gaining unauthorized access to protected resources. The scope-changed impact indicates the vulnerability crosses trust boundaries, affecting downstream resource servers and clients that rely on the authorization server for identity assertions.

Critical Impact
An authenticated attacker with minimal privileges can bypass authentication controls in the Spring Authorization Server, compromising confidentiality and integrity across downstream systems that trust its issued tokens.

Affected Products

Spring Authorization Server 7.0.0 through 7.0.4
Spring Authorization Server 1.5.0 through 1.5.6
Spring Authorization Server 1.4.0 through 1.4.9 and 1.3.0 through 1.3.10

Discovery Timeline

2026-07-16 - CVE-2026-22752 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-22752

Vulnerability Analysis

CVE-2026-22752 is classified as an authentication bypass by primary weakness in the Spring Authorization Server, a component of the Spring Security project that implements OAuth 2.1 and OpenID Connect 1.0 authorization server functionality. The flaw allows an attacker holding low-level credentials to circumvent authentication checks that should enforce identity verification before issuing tokens or granting access to protected endpoints.

Because the vulnerable component sits at the center of authorization decisions, a successful bypass produces cascading effects. Resource servers that validate access tokens issued by the authorization server may treat forged or improperly issued tokens as legitimate. The scope-changed classification reflects this cross-boundary impact, extending the blast radius beyond the authorization server itself.

Root Cause

The root cause resides in the primary authentication logic of the Spring Authorization Server. Specific technical details of the flawed code path have not been disclosed in the NVD entry. The Spring Security Advisory provides authoritative remediation guidance and version fix information.

Attack Vector

Exploitation occurs over the network against exposed authorization server endpoints. The attacker requires low-level privileges, meaning valid but unprivileged credentials or client registration are sufficient. No user interaction is required, and attack complexity is low. The vulnerability manifests during the authentication phase, before authorization decisions apply user-level restrictions.

No public proof-of-concept exploit code is available, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the vendor advisory for technical remediation details.

Detection Methods for CVE-2026-22752

Indicators of Compromise

Unexpected access token issuance events in Spring Authorization Server logs, particularly for clients or scopes not typically requested by the associated principal.
Authentication success events lacking corresponding credential validation entries in application logs.
Anomalous OAuth flow patterns, such as authorization code exchanges from unusual IP addresses or user agents.

Detection Strategies

Enable verbose authentication logging within Spring Security and forward events to a centralized log platform for correlation.
Baseline normal token issuance rates per client and alert on statistical deviations that may indicate abuse.
Correlate authorization server logs with downstream resource server access logs to identify tokens used against unexpected resources.

Monitoring Recommendations

Monitor the /oauth2/token, /oauth2/authorize, and introspection endpoints for abnormal request patterns and error rates.
Track failed and successful authentication attempts by client ID and source IP for behavioral analytics.
Alert on privilege changes and new client registrations that follow suspicious authentication events.

How to Mitigate CVE-2026-22752

Immediate Actions Required

Upgrade Spring Authorization Server to a fixed version as documented in the Spring Security Advisory.
Inventory all applications embedding Spring Authorization Server and prioritize internet-facing deployments for immediate patching.
Rotate signing keys and client secrets after patching to invalidate any tokens issued through exploitation of the vulnerability.

Patch Information

The Spring team has released fixes for each affected branch. Consult the Spring Security Advisory for the specific patched versions corresponding to the 7.0.x, 1.5.x, 1.4.x, and 1.3.x release lines. Update Maven or Gradle dependency declarations to reference the patched artifact versions and redeploy affected services.

Workarounds

Restrict network access to authorization server endpoints using firewall rules or service mesh policies until patching is complete.
Reduce access token lifetimes and enforce refresh token rotation to limit the utility of any tokens issued via bypass.
Enable mutual TLS or additional client authentication mechanisms at the gateway layer to add a defense-in-depth check before requests reach the authorization server.

bash

# Update Spring Authorization Server dependency to a patched release
# Example Maven dependency update — replace VERSION with a fixed release from the Spring advisory
# <dependency>
#   <groupId>org.springframework.security</groupId>
#   <artifactId>spring-security-oauth2-authorization-server</artifactId>
#   <version>VERSION</version>
# </dependency>

mvn versions:set-property -Dproperty=spring-authorization-server.version -DnewVersion=VERSION
mvn clean verify