org.springframework.security:spring-security-oauth2-jose

2 results · Feed

• Medium 5.3
  CVE-2026-22748

  Potential Security Misconfiguration when Using withIssuerLocation

  Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This issue affects Sprin…

  Spring Spring Security thingsboard-tb-node apache-nifi Wolfi Maven
  Apr 22, 2026
• Low 3.3
  CVE-2018-15801

  Authorization Bypass During JWT Issuer Validation with spring-security

  Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a m…

  Spring by Pivotal Spring Security org.springframework.security:spring-security-core org.springframework.security:spring-security-oauth2-jose Maven
  Dec 19, 2018